Repository navigation
[Decision] Should an administrator have a "purge this object's data" control that bypasses a package's locking rules? (gates #30891 item 3) #30939
Description
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Filing gate: ② a decision only the maintainer can make (a security boundary), split out of #30891, where the coordinator recorded it as an open maintainer question. ⛔ Not a claim.
维护者速读
- 问题： 你在会话里问过「我是管理员也不能清理历史数据吗？」。管理员是否应该有一个「清空此对象数据」的入口，绕过软件包的锁定规则（例如已关闭商机的子记录不可删）？
- 选项：
- A：不提供（协调席倾向）。 业务规则对管理员同样有效。要整体重置，走「移除示例数据」（objectstack-ai/cloud#3657）或卸载重装。MCP: delete records by filter in one confirmed call, with refusals grouped by reason, instead of one delete_record per row #30891 第 3 项按「管理员同样受锁定规则约束」实现，并有测试固定。
- B：提供，但限定条件。 例如只限平台管理员、需二次确认、写审计记录、只对示例或沙箱数据开放。需要另立实现卡，并把这条边界写进 ADR。
- 推荐：A。 绕过锁定规则是在扩大管理员的权限边界。B 的需求可以由现有的两条重置路径满足，不必新开后门。
影响
- 只卡 MCP: delete records by filter in one confirmed call, with refusals grouped by reason, instead of one delete_record per row #30891 的第 3 项。第 1、2 项（按条件预览、确认后删除、按原因分组的拒绝）照常开工。
Generated by Claude Code
Activity
objectstack-fleet commentedon Nov 7, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Closed as completed · 2026-11-07T14:52Z
⛔ Not a claim.
needs-user-decision. Triage listed it as pending for several rounds in error.delete_recordswith no administrator bypass of a package's locking rules, pinned by a dogfood test. MCP: delete records by filter in one confirmed call, with refusals grouped by reason, instead of one delete_record per row #30891 is closed.needs-user-decisionremoved.Generated by Claude Code