[Decision] 切换后谁能在 Setup 里新建/编辑岗位和权限集：保持今天的权限（持 manage_metadata 者），还是放开给组织管理员（安全边界） #22621

Activity

1. objectstack-fleet

   added

   priority:p1High: required for production / M2High: required for production / M2

   security

   needs-user-decisionBlocked on a maintainer decision — do not dispatch; decision cards only, never on a PRBlocked on a maintainer decision — do not dispatch; decision cards only, never on a PR

   domain:servicesRetired 2026-10-22, alias of domain:server (services surface); in-flight cards keep it until landedRetired 2026-10-22, alias of domain:server (services surface); in-flight cards keep it until landed

   target:v18

   area:accessPermissions that actually hold — RLS/FLS, sharing model, write-path guardsPermissions that actually hold — RLS/FLS, sharing model, write-path guards

   on Oct 10, 2026
2. objectstack-fleet commented on Oct 10, 2026

   

   objectstack-fleetBot

   on Oct 10, 2026

   ContributorAuthor

   More actions

   Ruling: batch #311 item 1 · letter A · maintainer 「同意」 2026-10-10T07:10Z

   Director seat, summon #36, session_019fWAt2renophxLVg5aJXMH (GitHub hotlong; written as objectstack-fleet[bot] via the relay). Batch #311 (three cards, this one first) was presented in chat with this seat's own readings and the recommendation A, fallback B; the maintainer answered 「同意」, which takes the recommendation. Freshness gate: the body (6,054 bytes, unedited since filing) and the comment list (none) were re-read before this record. Thread-read: none on this card.

   The ruling

   • A — the write authority over the security catalog stays what it is today. After the cutover, positions, permission sets and capabilities are written through the metadata door only, and that door's gate stays metaWriteCapabilityVerdict: a system write, or a caller holding manage_metadata (the platform administrator, through admin_full_access). Organization administrators stay read-only on the catalog in every posture, as the anti-escalation rule in default-permission-sets.ts (lines 426–431 and 475–479 on origin/main e22315238f) has had it: letting them write would let an organization administrator bind admin_full_access to themselves. Setup's catalog pages show them the catalog read-only and say why.
   • ⛔ Not taken: B (a new narrow "security catalog" system permission: a real enterprise pattern, zero measured pull, a permanent public surface, and still an escalation surface; it returns only with a named user) and C (opening the metadata door to organization administrators under single: a privilege-escalation path and a reversal of the anti-escalation rule, never a seat's to grant).

   Why A on the first axis

   One rule: definitions belong to metadata authors, and the authority to author metadata is manage_metadata. A adds nothing and corrects a premise rather than a boundary. ADR-0131 D2's "the security-administration authority an organization admin holds today (the object grants on the catalog)" names an authority that, read against the code, is read-only, so A is the literal reading of D2, and D7's "for capability holders" is the accurate wording. B and C both widen; only B is ever admissible, and only on pull.

   Corrections this ruling makes

   • This seat's own record 6094171670 on objectui#7611 (batch Release version 0.4.0 #310 item 1) said an organization administrator with no Studio capability creates and edits catalog items from Setup today and after the cutover, and named a "server half" (the metadata door accepting that administrator's write under single) as owed by the cutover. The premise was the ADR's sentence, not the code; the triage seat measured the code (this card), and the objectui lane already amended its copy (objectui#7611, 6094498192). The parity gate on objectui#7611 reads instead: under single, the platform administrator (a manage_metadata holder) creates, edits, deactivates and reactivates positions and permission sets from the same Setup page as today; an organization administrator sees the catalog read-only, with the reason. The "server half" item is withdrawn from the cutover plan (refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204).
   • ADR-0131 D2 and D3 get one dated sentence in the §8/D14 execution-plan paragraph that docs(adr-0131): §8/D14 execution-plan note — C2's remainder and C3 land as one cutover, C7 splits into C7a/C7b, and C12 moves to the 18.x line (rulings 6094045326, 6094175435, 6094183024) #22619 owes (Tier H): the authority an organization administrator holds on the catalog today is read-only; Setup authoring under single requires manage_metadata; D7's "for capability holders" is the accurate wording. No decision of the record changes.

   Prior rulings read: ADR-0131 D2/D3/D7; the anti-escalation rule (default-permission-sets.ts:426-431, :475-479); metaWriteCapabilityVerdict (metadata-core/src/meta-write-capability.ts:79-93); ADMIN_FULL_ACCESS_CAPABILITIES (eval-user.zod.ts:141, manage_metadata); S7's system-context definition write (position-write-through.ts:112); #22601 B (6094045326); batch #310 item 1 (6094171670); thread: none. 自检:只看①选 A;②③④是否翻转:否。

   State and execution

   • This card closes completed in this act; needs-user-decision leaves with the close; priority:p1, security, domain:services, target:v18, area:access stay. The body gains its Ruled: line in the same act.
   • Pointers: objectui#7611 (the parity gate as corrected above; the objectui lane builds it), refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204 (the cutover plan drops the server-half item; C7a's --plan on C7a (ADR-0131 D10, split from #15211): the migration inventory file, the read-only os migrate --plan, and the design of the ceremony's completion marker #22617 lists any custom permission set that grants a write on the four catalog objects), docs(adr-0131): §8/D14 execution-plan note — C2's remainder and C3 land as one cutover, C7 splits into C7a/C7b, and C12 moves to the 18.x line (rulings 6094045326, 6094175435, 6094183024) #22619 (the D2/D3 dated sentence). Workload of the chosen option, as the rule requires: zero server lines; C9's acceptance text rewritten.

   ---

   Generated by Claude Code
3. objectstack-fleet

   removed

   needs-user-decisionBlocked on a maintainer decision — do not dispatch; decision cards only, never on a PRBlocked on a maintainer decision — do not dispatch; decision cards only, never on a PR

   on Oct 10, 2026
4. objectstack-fleet

   closed this as completedon Oct 10, 2026
5. akarma-synetal

   added a commit that references this issue on Oct 28, 2026

   refactor: remove the retired permission-set catalog object's special …

   ...

   78b07f4