docs(adr): ADR-0091 accepted — grant lifecycle decisions confirmed; D3 gains the no-self-renewal rule - #2764
Merged
Merged
Conversation
…3 gains the no-self-renewal rule Review outcome: delegation keeps substitution (union) semantics with the 30-day configurable ceiling; break-glass stays unapproved with the 4h window (pre-authorization list + alert + D5 review as compensating controls); D1 scope stays confined to the two user-grant tables; D2 resolution-time filtering confirmed as the sole correctness mechanism. Added per review: a delegated row is not self-renewable — extension requires a NEW delegation by the delegator, with its own audit record. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012oLzaP8n7A3YKFmgaHWC8H
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
size/s
documentation
os-zhuang
marked this pull request as ready for review
July 10, 2026 09:48
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Review outcome for ADR-0091 (#2751): Status → Accepted (decider recorded). All seven decisions confirmed as proposed:
One addition from review: D3 rule 4 now cuts chains two ways — a delegated row is not re-delegatable and not self-renewable. The delegate cannot extend
valid_until; continuing past expiry requires a NEW delegation by the delegator (or an admin), leaving a fresh audit record. A "temporary" grant that can be quietly rolled forever is a permanent grant with extra steps.Implementation (L1: spec columns + resolver filtering + tests) starts after this merges, targeting 13.1.
Verification
Docs-only (one ADR file). No code, no changeset.
🤖 Generated with Claude Code
https://claude.ai/code/session_012oLzaP8n7A3YKFmgaHWC8H
Generated by Claude Code