Skip to content

04-security.md

Latest commit

 

History

History
26 lines (21 loc) · 1.63 KB

04-security.md

File metadata and controls

26 lines (21 loc) · 1.63 KB
Raw

Positions, permission sets, sharing rules, FLS, onEnable bindings

Milestone: M1 · Labels: pm:queue · Blocked-by: 02, 03

Scope

src/profiles/*.profile.ts (5 permission sets), src/sharing/positions.ts (7 positions), src/sharing/*.sharing.ts (6 rules), FLS declarations, src/security/bind-position-sets.ts + onEnable in objectstack.config.ts. Adds requires: ['sharing'].

Spec — DESIGN.md §04, verbatim

Positions, sets, the permission matrix, the six sharing rules and the FLS table are pinned there (global-first revision, 2026-09-07: no seal keeper; clm_records_manager covers execution and archive). Capabilities granted via systemPermissions: clm_requester.access · clm_legal.access · clm_finance.access · clm_records.access · clm_admin.access; action gates approve_contract · execute_contract · archive_contract · terminate_contract · manage_clauses · manage_approval_rules. contract_manager_reports uses writeScope: 'own_and_reports' only if declaring it does not require the hierarchy-security capability at validate time; if it does, declare the capability (it is safe on an open-edition boot — see HotCRM's objectstack.config.ts note) and record the edition boundary in the PR. Bindings: sys_position_permission_set rows cannot be seeds — bind on kernel:bootstrapped as ATS does.

Acceptance

  • Gates green. Two requester accounts cannot read each other's contracts through REST; a clm_legal account reads all; a clm_finance account reads no in_review contract.
  • clm_party.bank_account is absent from a requester's REST read.

Out of scope

Views/app gating (07).