D-IAM-1 preset roles from the directory; D-IAM-3 per-property authorization contract

.claude/board/ISSUES.md

@@ -3,6 +3,17 @@
 > Open blockers and cross-repo follow-ups. Append new entries at the top;
 > change only the `Status` line of an existing entry.
 
+## ISS-PRESET-VERBS-PROVISIONAL — the preset roles' verbs are written from seat names, not from HubSpot
+
+- **Status:** OPEN (D-IAM-1, 2026-10-21; operator to confirm or amend)
+- **Where:** `hubspo-iam::roles` (the verb table in the module docs), pinned by `each_seat_edits_exactly_its_own_concepts` and `only_the_admins_delete`.
+- **What:** every preset reads every plugged concept. Edit (write + create) and act: sales on contact, company, deal, lead, call, meeting, task, note, email, line item, quote/invoice (list edit only, sequence act only); service on contact, company, ticket, call, meeting, task, note, email (list edit); marketing on contact, company, campaign, email (list, note, task edit). Only the two admins delete; admin cannot delete users and teams (`PROJECT_ACTOR`). No HubSpot export backs this; the second oracle (rule 12) would.
+
+## ISS-PERMISSION-SETS-NOT-ROLES — tenant permission sets cannot be `RoleId`s
+
+- **Status:** OPEN (D-IAM-1, 2026-10-21; design needed)
+- **Where:** `lance_graph_contract::rbac::RoleId` is `&'static str`; `RbacPlug::roles` is a static list.
+- **What:** a HubSpot permission set is created by the tenant at runtime, so it cannot be a plugged role without leaking strings. Candidate shape: a permission set is tenant data that narrows one preset (per-concept verbs ⊆ the preset's, field masks per D-IAM-3), applied after the preset's decision; it never widens. Needs the request path (D-IAM-3) to apply it.
 ## ISS-SPEAR-DOCUMENT-CONTRACTS — spear has a content store but no document record, reference or authorization
 
 - **Status:** OPEN (found 2026-10-21 verifying D-DOC-1; upstream asks for the operator, not filed on spear)
@@ -30,7 +41,7 @@
 
 ## ISS-PACKED-RUN-RBAC-GRAIN — a packed run is granted as a whole, and contact's holds personal attributes
 
-- **Status:** DECIDED 2026-10-21 (operator) — option (b), with (c) allowed before the first tenant data. Storage grain may be a run; authorization grain is the property. Field 0 grants the container only; packed properties are checked one by one against an inner mask keyed by stable table ordinal, independent of the 256-position `WideFieldMask`. Requirements recorded on the D-IAM-3 row of STATUS_BOARD.
+- **Status:** DECIDED 2026-10-21 (operator) — option (b); (c) is defense in depth only, never a substitute. Contract: `hubspo_iam::fields` (D-IAM-3). Storage grain may be a run; authorization grain is the property. Field 0 grants the container only; packed properties are checked one by one against an inner mask keyed by stable table ordinal, independent of the 256-position `WideFieldMask`. Requirements recorded on the D-IAM-3 row of STATUS_BOARD.
 - **Where:** `hubspo-harvest::positions::PACKED_GROUPS`, `hubspo-schema::HubSpoClassView` (field 0).
 - **What:** a role granted field 0 of contact sees all 27 packed properties; one not granted it sees none. HubSpot's `facebook_ads_properties` group holds `date_of_birth`, `gender`, `marital_status` and `military_status` next to `school` and `seniority`, so a role cannot get the job fields without the personal ones. HubSpot itself marks all of them `non_sensitive`; DSGVO may not.
 - **Options for D-IAM-3:** (a) accept the grain and grant the run only to roles that may see all of it; (b) a second, run-internal mask keyed by table position (the run already stores positions); (c) keep the personal attributes out of the run by narrowing `PACKED_GROUPS` to names, with another group packed instead. Only (c) changes stored slots, and only before the first tenant data is written.

.claude/board/LATEST_STATE.md

@@ -216,6 +216,56 @@
   `remove` keeping rows (1 red). A `live` gate inside `add` stayed green
   and was removed: `members` already applies it on every read.
 
+## Preset roles (D-IAM-1, presets half)
+
+- `hubspo_port::RBAC_ROLES` names six roles: `crm_super_admin`,
+  `crm_admin`, `crm_sales_user`, `crm_service_user`, `crm_marketing_user`,
+  `crm_view_only`. The plug declares them; `hubspo-port` no longer holds a
+  grant source.
+- `hubspo_iam::roles::Catalogue` is the `GrantSource`: one const grant per
+  plugged concept (22) per role, built by a `const fn` from the verb table in
+  the module docs. `field_mask_of` is the default (`None`); column grants are
+  D-IAM-3. `roles_of` is empty: actors come from the request's identity,
+  resolved once per request.
+- `hubspo_iam::roles::bind()` binds `RBAC_PLUG` against OGAR green.
+- 12 tests: bind, defined roles, plug boundary, every role reads every
+  concept, view-only reads only, only admins delete, admin vs super admin on
+  users, each seat's editable set (`==`), create travels with write, actor
+  decisions through `ActorSource`, sequence enrol vs edit.
+- Five disable runs measured red: view-only given edit, sales given
+  delete, admin given user delete, an unknown role defined, service losing
+  tickets.
+- Request roles from the directory: `hubspo_iam::roles::request_actors`
+  wraps dir-sim's `ViewActors` (feature `rbac`): roles are granted to
+  security groups in one version of OGAR's group-role policy
+  (`GroupRoles::from_policy`), inherited through SID chains only, filtered
+  by the binding; an unread group refuses the request. 3 integration tests
+  over a dir-sim view (`tests/roles.rs`).
+- Open: `ISS-PRESET-VERBS-PROVISIONAL`, `ISS-PERMISSION-SETS-NOT-ROLES`.
+
+## Per-property read authorization (D-IAM-3, contract half)
+
+- `hubspo_iam::fields`: a read needs the outer mask (the role's
+  `WideFieldMask` over field positions: the property's lane, or 0 for the
+  packed run) and the inner grant (`PropertyGrants`, a set of stable
+  property ordinals per role and concept). The inner set names no lane, so
+  re-slotting a property changes no decision.
+- `WideFieldMask` cannot carry the inner set: `u8` positions cannot name
+  contact's 272 ordinals, and it has no schema version. Hence a local type,
+  no new upstream abstraction.
+- `Projection::compile` (once per request, per concept) records a `Stamp`:
+  concept, schema version, inner-grant generation, outer `PolicyVersion`.
+  Every read presents the current stamp: `project` drops hidden and unknown
+  properties from a row; `require` refuses a filter, sort or aggregate that
+  reads one; any stamp difference (another concept, schema version, a
+  revoked grant) refuses everything (Codex on #42).
+- 12 tests. Eight disable runs measured red: concept check off, grant
+  generation ignored, inner grant ignored, outer mask
+  ignored, stale version accepted, `require` passing hidden properties,
+  one role's outer mask combined with another's inner grant, an unread
+  directory group accepted.
+- Not yet wired into any output path, and no default grants per preset.
+
 ## Harvest (D-ONT-1, public-catalog half)
 
 - `scripts/fetch-hubspot-specs.sh` → `.cache/` (gitignored), then

.claude/board/STATUS_BOARD.md

@@ -71,9 +71,9 @@
 
 | D-id | Deliverable | Size | Status | Evidence |
 |---|---|---|---|---|
-| D-IAM-1 | Role catalogue: Super Admin, Admin, Sales/Service/Marketing user, view-only, custom permission sets; grant source with `field_mask_of` | M | Queued | 2026-10-20 inputs from lance-graph: (1) #1635/#1638 (D-RMAP-DIR-1, lab only) measured a dir-sim `View` walk as a full membership scan per call, 0.4–0.7 ms at 35k–263k rows; resolve an actor's roles once per request, never per record. The compiled closure (32–49 ns) is not admitted (ADMISSION open, D-RMAP-DIR-2 not authorized), so do not depend on `dir-rmap-probe`. (2) #1636 ACTION-GATE: an `ActionDef` with `required_role = None` skips RBAC in both `commit` and `commit_via`; the upstream recommendation is `commit_via` canonical and `None` only for actions declared public. Give every CRM action a role. |
+| D-IAM-1 | Role catalogue: Super Admin, Admin, Sales/Service/Marketing user, view-only, custom permission sets; grant source with `field_mask_of` | M | In progress | 2026-10-21 (authorized by the operator): the six presets ship. Role names are in `hubspo_port::RBAC_ROLES`; the grants are `hubspo_iam::roles::Catalogue` (one grant per plugged concept, provisional verb table); `hubspo_iam::roles::bind` binds the plug green. A request's roles come from the directory: `hubspo_iam::roles::request_actors` reads security-group grants (OGAR group-role policy via dir-sim `GroupRoles`/`ViewActors`) once per request and refuses on an unread group. 12 unit + 3 directory tests. Open: tenant permission sets (`ISS-PERMISSION-SETS-NOT-ROLES`); the preset verbs await operator confirmation (`ISS-PRESET-VERBS-PROVISIONAL`). 2026-10-20 inputs from lance-graph: (1) #1635/#1638 (D-RMAP-DIR-1, lab only) measured a dir-sim `View` walk as a full membership scan per call, 0.4–0.7 ms at 35k–263k rows; resolve an actor's roles once per request, never per record. The compiled closure (32–49 ns) is not admitted (ADMISSION open, D-RMAP-DIR-2 not authorized), so do not depend on `dir-rmap-probe`. (2) #1636 ACTION-GATE: an `ActionDef` with `required_role = None` skips RBAC in both `commit` and `commit_via`; the upstream recommendation is `commit_via` canonical and `None` only for actions declared public. Give every CRM action a role. |
 | D-IAM-2 | Ownership scopes (all / team / owned) as `ScopeSpec`; team hierarchy via `Dn128` subtree | M | Shipped | #30 + #31 (#31 fixes the nested-group P1 via lance-graph #1488 `members_transitive_within`; 8 tests). `hubspo-iam::scope` 2026-10-11: owner set from the dir-sim `View` (team = directly held team group + nested sub-teams), one Quack `IN` over the owner lane, stored as a mask; 6 tests, 2 disable runs red. P-AUTH-1 2026-10-10: scope as stored mask in the fold kernel ≤ 4.3 %; per-row owner check +43–49 %. Unblocked 2026-10-11: roles from directory groups via lance-graph-dir-sim `actors::ViewActors` + `GroupRoles::from_policy` (consumable by git) |
-| D-IAM-3 | Field-level permissions (sensitive properties) as per-role `WideFieldMask`; absent from the wire | M | Queued | 2026-10-21 operator ruling (`ISS-PACKED-RUN-RBAC-GRAIN`, option b): storage grain may be a packed run, authorization grain is the property. Field 0 grants the container, never its contents; packed properties are authorized one by one by stable table ordinal, in a mask that is not the 256-position `WideFieldMask`. Requirements: compile authorized fields once per request; check each packed property before serialization, render, export and workflow use; refuse filters, sorts and aggregations on hidden properties; never hand a raw packed run to an untrusted caller (debug, cache, direct API included); fail closed on missing, unknown or stale inner policy, invalidated on grant or schema change; negative test `school` vs `date_of_birth`. Option (c), high-risk properties in their own lanes, allowed before first tenant data. 2026-10-20: also needs D-IAM-1 (roles) and D-ONT-6 (field positions per concept) in HubSPO-rs, which the upstream note below missed. 2026-10-20 unblocked upstream: lance-graph #1556 `RbacBinding::with_class_field_defaults` + `field_mask_for` (role mask, else class default, else None), OGAR #358 `GrantSource::default_field_mask_of` feeding it in `OgarRbac::bind`, lance-graph #1558 `walk_rails_authorized` (hidden field never emitted, hidden rail not followed; use `visible_fields()`). Read lance-graph `.claude/knowledge/access-control-model.md` first: policy data keyed by classid, no reasoning |
+| D-IAM-3 | Field-level permissions (sensitive properties) as per-role `WideFieldMask`; absent from the wire | M | In progress | 2026-10-21 contract shipped (not yet wired to any output path): `hubspo_iam::fields` — outer `WideFieldMask` (lane, or position 0 for the run) ∧ inner `PropertyGrants` by stable ordinal; `Projection::compile` once per request, `project` drops hidden/unknown values, `require` refuses filters/sorts/aggregates on them, a projection compiled at another schema version refuses everything. 10 tests incl. `school` vs `date_of_birth`/`gender`/`marital_status`/`military_status`. Open: per-role default grants, wiring into REST/UI/export/events/workflow outputs. 2026-10-21 operator ruling (`ISS-PACKED-RUN-RBAC-GRAIN`, option b): storage grain may be a packed run, authorization grain is the property. Field 0 grants the container, never its contents; packed properties are authorized one by one by stable table ordinal, in a mask that is not the 256-position `WideFieldMask`. Requirements: compile authorized fields once per request; check each packed property before serialization, render, export and workflow use; refuse filters, sorts and aggregations on hidden properties; never hand a raw packed run to an untrusted caller (debug, cache, direct API included); fail closed on missing, unknown or stale inner policy, invalidated on grant or schema change; negative test `school` vs `date_of_birth`. Option (c), high-risk properties in their own lanes, allowed before first tenant data. 2026-10-20: also needs D-IAM-1 (roles) and D-ONT-6 (field positions per concept) in HubSPO-rs, which the upstream note below missed. 2026-10-20 unblocked upstream: lance-graph #1556 `RbacBinding::with_class_field_defaults` + `field_mask_for` (role mask, else class default, else None), OGAR #358 `GrantSource::default_field_mask_of` feeding it in `OgarRbac::bind`, lance-graph #1558 `walk_rails_authorized` (hidden field never emitted, hidden rail not followed; use `visible_fields()`). Read lance-graph `.claude/knowledge/access-control-model.md` first: policy data keyed by classid, no reasoning |
 | D-IAM-4 | Directory ingest (ogar-ad / ogar-az / native), seat assignment as directory simulation plans | L | Queued |  |
 | D-IAM-5 | Partitioning (business units / brands) as tenant sub-scopes | M | Queued |  |
 | D-IAM-6 | Accumulation guard: exports / cohort reports require an extra grant | S | Queued |  |

crates/hubspo-iam/Cargo.toml

@@ -9,11 +9,15 @@ repository.workspace = true
 publish = false
 
 [dependencies]
-lance-graph-dir-sim.workspace = true
+hubspo-generated = { path = "../hubspo-generated" }
+hubspo-port = { path = "../hubspo-port" }
+lance-graph-contract.workspace = true
+ogar-rbac.workspace = true
+ogar-vocab.workspace = true
+lance-graph-dir-sim = { workspace = true, features = ["rbac"] }
 lance-graph-quack.workspace = true
 ogar-dir-core.workspace = true
 
-
 [dev-dependencies]
 lance-graph-mask-risc.workspace = true