From df7dabd01f3b01582fe3479dbba81439318bc387 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 10 Oct 2026 15:37:18 +0000 Subject: [PATCH] Handover correction: group as delegation object is valid for SendAs/SendOnBehalf The HubSPO-rs handover listed a group as owner as a violation for every mailbox right; it holds for FullAccess only. Adds the deny-entry and nested-group dependencies raised on #344. Appended, not edited. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01PPcakjk7ioQsnasmNDtc5z --- .../2026-10-10-1600-hubspo-rs-to-ogar-dir-sim.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.claude/handovers/2026-10-10-1600-hubspo-rs-to-ogar-dir-sim.md b/.claude/handovers/2026-10-10-1600-hubspo-rs-to-ogar-dir-sim.md index 2a69c0a..edceaaa 100644 --- a/.claude/handovers/2026-10-10-1600-hubspo-rs-to-ogar-dir-sim.md +++ b/.claude/handovers/2026-10-10-1600-hubspo-rs-to-ogar-dir-sim.md @@ -77,3 +77,16 @@ permission). That is enough for reading a shared inbox (HubSPO-rs D-MAIL-5). - **Send-as / on behalf:** not offered until W-1 exists. HubSPO-rs will not keep a second copy of AD's delegation lists. + +## Correction (2026-10-10, after OGAR #344 V17) + +- **W-1's violation list was too broad.** It named "a group as owner (a + group has no mailbox of its own)" as a violation for every right. That + holds for **FullAccess only**. Exchange grants SendAs and SendOnBehalf on + distribution groups, so a group is a valid object for those two rights. + V17 (`docs/DIRECTORY-SIMULATION-POC.md`) has it right. +- **Deny entries.** Exchange allows deny entries on FullAccess. A model that + reads grants only must not apply a grant a witness also denies: drop it, + or hold it as a violation (review on #344). +- **Transitive group trustees** depend on nested-group expansion, which is + lance-graph handover W-4.