QUA-1806: Document team permissions for check ownership, anomaly assignment, and Drafter dry-run

[RafaelOsiro]

Overview

Updates the team-permission documentation to reflect new role capabilities for check ownership, anomaly assignment, and Drafter dry-run privileges introduced in Release v2026.5.7.

Key Changes

• Author / Editor: gained the ability to assign users to anomalies; matrix and capability bullets updated.
• Drafter / Author / Editor: can now run Dry Run on a check; matrix updated and capability bullets added.
• Drafter / Author / Editor: can set the check Owner and Default Anomaly Assignee; matrix updated, with a note clarifying that Drafters can only set these fields while creating a draft check.
• Editor: added a new capability bullet for View masked field values, including the Show masked values toggle in Dry Run.
• Drafter: clarified that "cannot validate checks" refers to the Validate action specifically (Dry Run is allowed); reworded the Dry Run bullet from "validate logic" to "test logic" to remove the conflict.
• Author / Drafter: added a Dry Run and Masked Fields admonition explaining the Show masked values toggle is only visible to Editors.
• Editor: added a Dry Run with Unmasked Values admonition explaining the privilege.
• Reporter: fixed two pre-existing em-dashes in the intro and Includes paragraphs.

Pages to Test

• http://localhost:8000/settings/security/teams/team-permissions/author/
• http://localhost:8000/settings/security/teams/team-permissions/drafter/
• http://localhost:8000/settings/security/teams/team-permissions/editor/
• http://localhost:8000/settings/security/teams/team-permissions/reporter/
• http://localhost:8000/settings/security/teams/team-permissions/viewer/

[greptile-apps]

Greptile Summary

This PR updates five team-permissions pages to reflect new capabilities introduced in Release v2026.5.7: Dry Run access for Drafter and Author, anomaly user-assignment for Author and Editor, and the ability to set Check Owner / Default Anomaly Assignee across Drafter, Author, and Editor.

• Capability tables across all five role pages gain two new rows (Set Check Owner / Default Anomaly Assignee and Assign Users to Anomaly), and Author/Drafter's Dry Run Check rows flip from ✗ to ✓.
• New admonitions on Author, Drafter, and Editor pages explain the masked-field behavior during Dry Run, and a clarifying note on the Drafter page scopes the Owner/Assignee write to draft-creation time only.
• reporter.md also fixes two pre-existing em-dashes (replaced with a colon and a semicolon).

Confidence Score: 4/5

Documentation-only change with well-structured, internally consistent updates across all five role pages; safe to merge.

All capability matrix changes are consistent across the five pages, the new admonitions accurately reflect the intended privilege boundaries, and the note scoping Drafter's Owner/Assignee write to draft creation is correct. Two minor style observations: the Author Dry Run bullet uses "validate check logic" where the Drafter page deliberately switched to "test logic" for clarity, and the Drafter matrix shows an unconditional checkmark for a permission scoped to draft creation only.

author.md and drafter.md warrant a quick look at the two style observations; the other three files are straightforward.

Important Files Changed

Filename	Overview
docs/settings/security/teams/team-permissions/author.md	Adds Dry Run, anomaly assignment, and Owner/Default Anomaly Assignee capabilities for Author; matrix updated and new masked-fields admonition added. Minor wording inconsistency: Dry Run bullet uses "validate check logic" rather than "test logic" used in the Drafter equivalent.
docs/settings/security/teams/team-permissions/drafter.md	Adds Dry Run and Owner/Default Anomaly Assignee capabilities for Drafter; adds clarifying note and admonition; matrix updated. The matrix shows "Allowed" for Set Check Owner unconditionally, though the permission is actually conditional (draft creation only) — clarified in a note below.
docs/settings/security/teams/team-permissions/editor.md	Adds Owner/Default Anomaly Assignee and Assign Users to Anomaly rows to the matrix; adds a "View masked field values" capability bullet and a "Dry Run with Unmasked Values" admonition. All changes are clear and consistent.
docs/settings/security/teams/team-permissions/reporter.md	Adds the two new matrix rows (both Not allowed), and replaces em-dashes with colons/semicolons in the intro and Includes section.
docs/settings/security/teams/team-permissions/viewer.md	Adds the two new matrix rows (both Not allowed). No prose or admonition changes; straightforward update.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    DR[Dry Run Check]
    OA[Set Check Owner /\nDefault Anomaly Assignee]
    AA[Assign Users to Anomaly]
    MV[Show Masked Values\nin Dry Run]

    Editor -->|Full| DR
    Editor -->|Full| OA
    Editor -->|Full| AA
    Editor -->|Only role| MV

    Author -->|New| DR
    Author -->|Full| OA
    Author -->|New| AA
    Author -->|Masked| MV

    Drafter -->|New| DR
    Drafter -->|Draft creation only| OA
    Drafter -->|Not allowed| AA
    Drafter -->|Masked| MV

    Viewer -->|Not allowed| DR
    Viewer -->|Not allowed| OA
    Viewer -->|Not allowed| AA

    Reporter -->|Not allowed| DR
    Reporter -->|Not allowed| OA
    Reporter -->|Not allowed| AA

Loading

_{Reviews (1): Last reviewed commit: "docs(team-permissions): document check o..." | Re-trigger Greptile}

[greptile-apps]

The new Dry Run capability bullet uses "validate check logic," but the PR explicitly changed the same phrasing in drafter.md to "test its logic" to avoid conflating Dry Run with the distinct Validate action. Authors can use the Validate action, so the conflict is less severe here, but the inconsistent terminology between two parallel role pages describing the same feature may still cause reader confusion about what Dry Run actually does versus what "Validate" does.

Suggested change

	- Run a [Dry Run](../../../../datastore-checks/dry-run.md){:target="_blank"} to validate check logic
	- Run a [Dry Run](../../../../datastore-checks/dry-run.md){:target="_blank"} to test check logic before or after activation

[greptile-apps]

Unconditional "Allowed" for a conditionally scoped permission

The matrix row for Set Check Owner / Default Anomaly Assignee shows a plain ✅ "Allowed," identical to what Editor and Author display. However, Drafters can only exercise this capability during draft check creation — once activated, it requires Author or Editor. A reader scanning the matrix alone (without reading the note below) would reasonably conclude the permission is equivalent across these three roles, which is incorrect. Consider adding an asterisk or a * footnote in the cell, or renaming the matrix row to reflect the scope (e.g., Set Check Owner / Default Anomaly Assignee (draft only)).

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!