Skip to content

docs(adr): ADR-0091 accepted — grant lifecycle decisions confirmed; D3 gains the no-self-renewal rule #2764

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
os-zhuang merged 1 commit into from
Jul 10, 2026
Merged

docs(adr): ADR-0091 accepted — grant lifecycle decisions confirmed; D3 gains the no-self-renewal rule #2764

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 9 additions & 5 deletions docs/adr/0091-grant-lifecycle-and-recertification.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# ADR-0091: Grant lifecycle — effective-dated assignments, delegation, break-glass, recertification substrate

- **Status:** Proposed
- **Date:** 2026-07-09
- **Deciders:** (pending review)
- **Status:** Accepted
- **Date:** 2026-07-09 (proposed) · 2026-07-10 (accepted)
- **Deciders:** jack@objectstack.ai
- **Relates to:** ADR-0090 (Permission Model v2 — named follow-up #1), ADR-0057 (assignment tables), ADR-0049 (no unenforced security properties), ADR-0016 (open-core boundary)

## TL;DR
Expand Down Expand Up @@ -106,8 +106,12 @@ A user may delegate a position they hold **without being an admin**, iff:
checked by the same gate that owns assignment writes (D12 gate grows a
self-service branch: delegator ≠ admin, but the write is scoped to
positions they hold + delegatable + time-boxed);
4. chains are cut: a row with `delegated_from` set is **not itself
delegatable** (no re-delegation);
4. chains are cut TWO ways: a row with `delegated_from` set is **not itself
delegatable** (no re-delegation), and it is **not self-renewable** — the
delegate cannot extend `valid_until`; continuing past expiry requires the
delegator (or an admin) to issue a NEW delegation, leaving a fresh audit
record. A "temporary" grant that can be quietly rolled forever is a
permanent grant with extra steps;
5. dual audit: the row carries both `granted_by` (writer) and
`delegated_from` (authority source); explain reports "via delegation from
张三, until …".
Expand Down