Permission Model v2 — named follow-up ADRs (post-ADR-0090 parking lot)

[os-zhuang]

Successor to #2696 (ADR-0090 tracking — now fully delivered and closed). This issue carries the six named follow-up ADRs that ADR-0090 §"Non-goals and named follow-ups" acknowledged and deliberately scoped out of the v2 launch window. None of them changes the v2 breaking surface; each has a workable substitute today.

Convention: per the repo's ADR discipline, the ADR for each item is opened when the work actually starts — this issue is the parking lot, not a commitment to write six documents up front.

The six follow-ups

• 1. Grant lifecycle & recertification — time-boxed assignments (valid_from/valid_until), delegation-of-duty during absence, break-glass elevation with auto-expiry, periodic access-review campaigns (SOX/等保). Also the substrate for task-scoped, time-boxed AI-agent grants (D10) — the agent story is a second trigger for this one.
  Today's substitute: permanent grants + manual review.
• 2. Segregation of Duties (SoD) — declarative conflict rules between permission sets ("vendor-create must not combine with payment-approve"), checked at assignment time, with an audit report. Joins the D7 lint family.
  Today's substitute: org process / manual audit.
• 3. Scale & reorg hardening — membership-set materialization/caching, asynchronous share recalculation, batched BU-subtree moves. Hard gate: 100k-user × 10M-record benchmark — without it, D6 explain/matrix don't hold at enterprise scale. The most engineering-debt-like of the six.
  Today's substitute: per-request resolution, fine at current tenant sizes.
• 4. ERP dimension restrictions — declarative "rows where field ∈ my values" (Frappe User-Permissions shape) as first-class metadata; admin picks dimension values in the UI, platform compiles the row filter.
  Today's substitute: hand-written RLS/CEL.
• 5. ALM / environment promotion — export/import + semantic diff of positions/bindings across dev→test→prod, reusing the D6 access-matrix as the diff layer (two environment snapshots subtracted = promotion pre-flight report).
  Today's substitute: manual reconfiguration per environment.
• 6. Portal identity & licensing — the product track that activates D11 (externalSharingModel) at scale: external registration/auth (separate identity pool vs invite), external-seat licensing/metering. Mechanism is fully shipped (spec shape, runtime enforcement, Studio dial); this is the productization decision.
  Today's substitute: D11 mechanism usable ad hoc; no external identity product.

Suggested priority (non-binding)

#3 (hard benchmark gate) and #1 (compliance + the D10 agent-grant substrate) are the likeliest first pulls; #6 activates whenever the portal product track starts. #2/#4/#5 are demand-driven.

References

• ADR-0090: docs/adr/0090-permission-model-v2-concept-convergence.md §"Non-goals and named follow-ups"
• Predecessor tracking issue: ADR-0090: Permission Model v2 — concept convergence, final naming, AI-authoring safety (tracking) #2696 (all platform + UI deliverables shipped; see closing comment there for the final delivery map)

🤖 Generated with Claude Code