[AdaWorldAPI]

D-IAM-1: preset roles

• hubspo_port::RBAC_ROLES names six roles: crm_super_admin, crm_admin, crm_sales_user, crm_service_user, crm_marketing_user and crm_view_only. hubspo-port keeps only the plug declaration.
• hubspo_iam::roles::Catalogue is the OGAR GrantSource: one grant per plugged concept (22) per role. roles::bind() binds RBAC_PLUG against OGAR without errors.
• Roles come from the directory. roles::request_actors reuses dir-sim's ViewActors:
  • roles are granted to security groups in OGAR's group-role policy (GroupRoles::from_policy);
  • they are inherited through SID chains only, and the binding filters them;
  • they are read once per request;
  • a group whose grants were never read refuses the request.
• The verb table is provisional (ISS-PRESET-VERBS-PROVISIONAL). Tenant permission sets are open (ISS-PERMISSION-SETS-NOT-ROLES).

D-IAM-3 contract (ISS-PACKED-RUN-RBAC-GRAIN, option b)

hubspo_iam::fields decides a read with two masks, and both must allow it:

• outer: the role's WideFieldMask. It checks the property's lane, or position 0, which covers only the packed container;
• inner: PropertyGrants, a set of stable property ordinals per role and concept. It never names a lane, so re-slotting a property changes no decision.

Why not reuse the existing masks: WideFieldMask cannot represent the inner set. Its positions are u8, which cannot name contact's 272 ordinals, and it carries no schema version. So the inner set is a local type, and no upstream abstraction is added.

How it is used:

• Projection::compile runs once per request and concept. It records a Stamp: concept, schema version, the PropertyGrants generation and the outer PolicyVersion.
• Every read presents the current stamp:
  • project drops hidden and unknown properties;
  • require refuses filters, sorts and aggregates over them;
  • any stamp difference refuses everything: another concept, another schema version, or a revoked grant (Codex review).

Not yet done: wiring into output paths, which do not exist yet, and default grants per role.

Tests

• hubspo-iam: 24 unit tests (12 roles + 12 fields) and 3 directory integration tests.
• Negative tests: a grant on school exposes none of date_of_birth, gender, marital_status or military_status, in output or in predicates.
• A deal projection is refused on a contact row, and a revoked grant invalidates the projection.
• 14 disable runs, each red:
  • roles (5): view-only given edit, sales given delete, admin given user delete, an unknown role defined, service losing tickets;
  • fields (8): inner grant ignored, outer mask ignored, stale schema version accepted, require passing hidden properties, cross-role mask combination, concept not stamped, admits ignoring the concept, revoke not bumping the generation;
  • directory (1): an unread group accepted.
• cargo fmt --check, cargo clippy -D warnings and cargo test --workspace are green.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PPcakjk7ioQsnasmNDtc5z

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T00:49:59.318076Z	e20ba13	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e20ba1300d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".