From c7cddf3ce6dbfa23999a3aad585df1204d4a50f9 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 10 Jul 2026 09:30:24 +0000 Subject: [PATCH] =?UTF-8?q?docs(adr):=20ADR-0091=20accepted=20=E2=80=94=20?= =?UTF-8?q?grant=20lifecycle=20decisions=20confirmed;=20D3=20gains=20the?= =?UTF-8?q?=20no-self-renewal=20rule?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review outcome: delegation keeps substitution (union) semantics with the 30-day configurable ceiling; break-glass stays unapproved with the 4h window (pre-authorization list + alert + D5 review as compensating controls); D1 scope stays confined to the two user-grant tables; D2 resolution-time filtering confirmed as the sole correctness mechanism. Added per review: a delegated row is not self-renewable — extension requires a NEW delegation by the delegator, with its own audit record. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_012oLzaP8n7A3YKFmgaHWC8H --- .../0091-grant-lifecycle-and-recertification.md | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/docs/adr/0091-grant-lifecycle-and-recertification.md b/docs/adr/0091-grant-lifecycle-and-recertification.md index 6784a0736b..06a206bd80 100644 --- a/docs/adr/0091-grant-lifecycle-and-recertification.md +++ b/docs/adr/0091-grant-lifecycle-and-recertification.md @@ -1,8 +1,8 @@ # ADR-0091: Grant lifecycle — effective-dated assignments, delegation, break-glass, recertification substrate -- **Status:** Proposed -- **Date:** 2026-07-09 -- **Deciders:** (pending review) +- **Status:** Accepted +- **Date:** 2026-07-09 (proposed) · 2026-07-10 (accepted) +- **Deciders:** jack@objectstack.ai - **Relates to:** ADR-0090 (Permission Model v2 — named follow-up #1), ADR-0057 (assignment tables), ADR-0049 (no unenforced security properties), ADR-0016 (open-core boundary) ## TL;DR @@ -106,8 +106,12 @@ A user may delegate a position they hold **without being an admin**, iff: checked by the same gate that owns assignment writes (D12 gate grows a self-service branch: delegator ≠ admin, but the write is scoped to positions they hold + delegatable + time-boxed); -4. chains are cut: a row with `delegated_from` set is **not itself - delegatable** (no re-delegation); +4. chains are cut TWO ways: a row with `delegated_from` set is **not itself + delegatable** (no re-delegation), and it is **not self-renewable** — the + delegate cannot extend `valid_until`; continuing past expiry requires the + delegator (or an admin) to issue a NEW delegation, leaving a fresh audit + record. A "temporary" grant that can be quietly rolled forever is a + permanent grant with extra steps; 5. dual audit: the row carries both `granted_by` (writer) and `delegated_from` (authority source); explain reports "via delegation from 张三, until …".