@@ -0,0 +1,22 @@
+---
+'@objectstack/core': minor
+'@objectstack/plugin-security': minor
+'@objectstack/runtime': patch
+---
+
+feat(core,plugin-security)!: a grant applies only in its own organization — an organization-less grant row confers nothing, and the Default Organization's `admin_full_access` grant is the only platform-admin anchor
+
+Clause-②: yes (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any metadata schema is removed, renamed or re-shaped, so there is nothing for `objectstack migrate meta` to rewrite and no tombstone. The data change this relies on is the operator's ownership ceremony, `os migrate organization-ownership`, which an upgraded database must have passed before it boots. -->
+
+**BREAKING** for a stored grant row that carries no `organization_id` (`NULL`, absent or blank), shipped as `minor` under the repo's launch-window convention for breaking changes (ADR-0131 D10). After the ownership ceremony no such row exists: it attributes every one to an organization and makes the column NOT NULL, a server refuses a database it did not create or certify, and a fresh install that registers the organization object never writes one. So on a certified or fresh database nothing resolves differently.
+
+- **`resolveUserAuthzGrants` / `resolveAuthzContext` (`@objectstack/core`).** A `sys_user_position` or `sys_user_permission_set` row applies only while its organization is the active one. FROM: a row with no organization was "global" and applied in every resolution, including one with no active organization. TO: it applies nowhere, and a resolution with no active organization gets no stored grant at all.
+- **Platform-admin standing.** FROM: under `single`, an organization-less `admin_full_access` grant anchored `platform_admin`, beside the Default Organization's. TO: only the Default Organization's grant anchors it (still in every organization, and with none active). Walled postures are unchanged: standing there comes from `OS_PLATFORM_OWNER_EMAIL` alone.
+- **`bootstrapPlatformAdmin` (`@objectstack/plugin-security`).** The existing-admin check reads only the Default Organization's grant. When no Default Organization can be named (a walled posture, or none to name), it reads no grant at all. The walled "no owner email declared" error drops its sentence about a legacy unscoped grant row.
+- **The delegated-administration gate.** A held position counts toward self-delegation only when its row belongs to the caller's active organization. An organization-less holding, or a caller with no active organization, holds nothing there, which is what the resolver grants. An organization administrator's removal of an organization-less row is refused as "not one of the organization you administer".
+- **The run-lifecycle refusal (`@objectstack/runtime`).** Under `single` it now names the Default Organization's `admin_full_access` grant as the remedy, where it named an unscoped one.
+- **What a lean composition sees.** A composition that registers no organization object (`sys_organization`, which plugin-auth ships) still stores grants without an organization, and those grants now confer nothing. No shipped composition does this: `os serve` registers the security plugin only together with plugin-auth.
+
+**What an operator does.** Nothing beyond the upgrade itself: run `os migrate organization-ownership` before serving a database that 17.x or an 18.0 pre-release created. The server refuses such a database until you do. If an embedding composes `@objectstack/plugin-security` without plugin-auth, register the organization object so that grants carry an organization.
@@ -267,17 +267,22 @@ const APP = {
 };
 const LEDGER_FILE = 'com.acme.gated.json';
 
-/** Every test user holds the authoring capability, so a refusal below is the gate's alone. */
+/**
+ * Every test user holds the authoring capability, so a refusal below is the gate's alone:
+ * the `admin_full_access` grant owned by the Default Organization, which applies with no
+ * active organization.
+ */
 function grantRows(): Record<string, any[]> {
     return {
+        sys_organization: [{ id: 'org_default', slug: 'default' }],
         sys_user: Object.keys(POSTURES).map((id) => ({ id, email: `${id}@acme.test` })),
         sys_member: [],
         sys_user_position: [],
         sys_position: [],
         sys_metadata_activation: [],
         sys_position_permission_set: [],
         sys_user_permission_set: Object.keys(POSTURES).map((id, i) => ({
-            id: `ups${i}`, user_id: id, permission_set_id: 'ps1', permission_set: 'admin_full_access', organization_id: null,
+            id: `ups${i}`, user_id: id, permission_set_id: 'ps1', permission_set: 'admin_full_access', organization_id: 'org_default',
         })),
         sys_permission_set: [{ id: 'ps1', name: 'admin_full_access', system_permissions: ['manage_metadata', 'studio.access', 'setup.access'] }],
     };
 
@@ -56,19 +56,24 @@ function makeC(url: string, body?: any) {
     };
 }
 
+/** The organization the sessions act in, and the one {@link setupAccessEngine}'s grant is owned by. */
+const ORG = 'o1';
+
 const sessionAuth = (userId?: string) => ({
-    api: { getSession: async () => (userId ? { user: { id: userId } } : null) },
+    api: { getSession: async () => (userId ? { user: { id: userId }, session: { activeOrganizationId: ORG } } : null) },
 });
 
 /**
  * [#24148] A data engine under which `userId` holds `setup.access` — what
  * `/status` serves its full answer behind. Real permission-set rows, read by
- * the shared resolver through `find`.
+ * the shared resolver through `find`. The grant is owned by {@link ORG}, the
+ * organization the session acts in: a grant applies only in its own
+ * organization.
  */
 const setupAccessEngine = (userId: string) => {
     const rows: Record<string, any[]> = {
         sys_user: [{ id: userId, email: `${userId}@example.test` }],
-        sys_user_permission_set: [{ id: 'ups_1', user_id: userId, permission_set_id: 'ps_1', permission_set: 'setup_admin', organization_id: null }],
+        sys_user_permission_set: [{ id: 'ups_1', user_id: userId, permission_set_id: 'ps_1', permission_set: 'setup_admin', organization_id: ORG }],
         sys_permission_set: [{ id: 'ps_1', name: 'setup_admin', system_permissions: ['setup.access'] }],
     };
     return bindCatalogFromTables({ find: async (object: string) => rows[object] ?? [] }, rows);
 
@@ -35,10 +35,11 @@ const CC = '/api/v1/cloud-connection';
 const ORIGIN = 'https://env.example.test';
 const CLOUD = 'http://cloud.test';
 
-/** Holds `setup.access`, which the two bind doors demand. */
+/** Holds `setup.access`, which the two bind doors demand — in {@link ORG}, the organization the session acts in. */
 const ADMIN = 'u_admin';
+const ORG = 'o1';
 const GRANTS: Record<string, any[]> = {
-    sys_user_permission_set: [{ id: 'ups_1', user_id: ADMIN, permission_set_id: 'ps_1', permission_set: 'setup_admin', organization_id: null }],
+    sys_user_permission_set: [{ id: 'ups_1', user_id: ADMIN, permission_set_id: 'ps_1', permission_set: 'setup_admin', organization_id: ORG }],
     sys_permission_set: [{ id: 'ps_1', name: 'setup_admin', system_permissions: ['setup.access'] }],
 };
 
@@ -95,7 +96,7 @@ async function mount(mode: Mode, discovery: Discovery) {
         post: (p: string, h: Handler) => routes.set(`POST ${p}`, h),
     };
     const hooks = new Map<string, any>();
-    const auth = { api: { getSession: async () => ({ user: { id: ADMIN }, session: { id: 'sess_admin' } }) } };
+    const auth = { api: { getSession: async () => ({ user: { id: ADMIN }, session: { id: 'sess_admin', activeOrganizationId: ORG } }) } };
     const objectql = bindCatalogFromTables({ find: async (object: string) => GRANTS[object] ?? [] }, GRANTS);
     const protocol = discovery === 'real'
         ? discoveryProducer()
 
@@ -38,20 +38,22 @@ import { bindCatalogFromTables } from './__tests__/security-catalog.testkit.js';
 const CC = '/api/v1/cloud-connection';
 const ORIGIN = 'https://env.example.test';
 
-/** Holds `setup.access` through an unscoped grant (the platform-admin shape). */
+/** Holds `setup.access` through the Default Organization's `admin_full_access` grant (the platform-admin shape: it applies with no active organization). */
 const ADMIN = 'u_setup_admin';
 /** Holds `setup.access` through a grant scoped to the organization its session is active in (the organization-admin shape). */
 const ORG_ADMIN = 'u_org_admin';
-/** Signed in, holds a permission set, and the set carries no `setup.access`. */
+/** Signed in, holds a permission set in the organization its session is active in, and the set carries no `setup.access`. */
 const MEMBER = 'u_member';
-/** Holds `setup.access`, but the ADR-0069 policy holds the session. */
+/** Holds `setup.access` (the platform-admin shape, as {@link ADMIN}), but the ADR-0069 policy holds the session. */
 const HELD_ADMIN = 'u_held_admin';
 
 const ORG = 'org_a';
+/** The Default Organization — the owner of the one `admin_full_access` grant that anchors platform standing. */
+const DEFAULT_ORG = 'org_default';
 const SESSIONS: Record<string, { activeOrganizationId?: string; authGate?: { code: string; message: string } }> = {
     [ADMIN]: {},
     [ORG_ADMIN]: { activeOrganizationId: ORG },
-    [MEMBER]: {},
+    [MEMBER]: { activeOrganizationId: ORG },
     [HELD_ADMIN]: { authGate: { code: 'PASSWORD_EXPIRED', message: 'You must change your password before continuing.' } },
 };
 
@@ -61,18 +63,20 @@ const ADMIN_KEY = 'osk_setup_admin_key_24148';
 function grantRows(): Record<string, any[]> {
     return {
         sys_user: Object.keys(SESSIONS).map((id) => ({ id, email: `${id}@example.test` })),
+        sys_organization: [{ id: DEFAULT_ORG, slug: 'default' }, { id: ORG, slug: 'org-a' }],
         sys_member: [{ id: 'mem_1', user_id: ORG_ADMIN, organization_id: ORG, role: 'admin' }],
         sys_user_position: [],
         sys_position: [],
         sys_metadata_activation: [],
         sys_position_permission_set: [],
         sys_user_permission_set: [
-            { id: 'ups_admin', user_id: ADMIN, permission_set_id: 'ps_setup', permission_set: 'setup_admin', organization_id: null },
+            { id: 'ups_admin', user_id: ADMIN, permission_set_id: 'ps_full', permission_set: 'admin_full_access', organization_id: DEFAULT_ORG },
             { id: 'ups_org_admin', user_id: ORG_ADMIN, permission_set_id: 'ps_setup', permission_set: 'setup_admin', organization_id: ORG },
-            { id: 'ups_held', user_id: HELD_ADMIN, permission_set_id: 'ps_setup', permission_set: 'setup_admin', organization_id: null },
-            { id: 'ups_member', user_id: MEMBER, permission_set_id: 'ps_member', permission_set: 'member_basic', organization_id: null },
+            { id: 'ups_held', user_id: HELD_ADMIN, permission_set_id: 'ps_full', permission_set: 'admin_full_access', organization_id: DEFAULT_ORG },
+            { id: 'ups_member', user_id: MEMBER, permission_set_id: 'ps_member', permission_set: 'member_basic', organization_id: ORG },
         ],
         sys_permission_set: [
+            { id: 'ps_full', name: 'admin_full_access', system_permissions: ['manage_metadata', 'studio.access', 'setup.access'] },
             { id: 'ps_setup', name: 'setup_admin', system_permissions: ['setup.access'] },
             { id: 'ps_member', name: 'member_basic', system_permissions: ['export_data'] },
         ],
 
@@ -55,15 +55,18 @@ function makeRawApp() {
         post: (p: string, h: Handler) => routes.set(`POST ${p}`, h),
     };
 }
-const sessionAuth = (userId?: string) => ({ api: { getSession: async () => (userId ? { user: { id: userId } } : null) } });
+/** The organization the sessions act in, and the one {@link ADMIN_GRANTS}' grant is owned by. */
+const ORG = 'o1';
+const sessionAuth = (userId?: string) => ({ api: { getSession: async () => (userId ? { user: { id: userId }, session: { activeOrganizationId: ORG } } : null) } });
 /**
  * [#24148] The suites below sign in as `admin`, who must hold `setup.access` to
  * reach the connection-changing doors (their subject is the credential, not the
  * permission — that is `cloud-connection-setup-access.pin.test.ts`). Real
- * permission-set rows, read by the shared resolver through `find`.
+ * permission-set rows, read by the shared resolver through `find`; the grant is
+ * owned by {@link ORG}, the organization the session acts in.
  */
 const ADMIN_GRANTS: Record<string, any[]> = {
-    sys_user_permission_set: [{ id: 'ups_1', user_id: 'admin', permission_set_id: 'ps_1', permission_set: 'setup_admin', organization_id: null }],
+    sys_user_permission_set: [{ id: 'ups_1', user_id: 'admin', permission_set_id: 'ps_1', permission_set: 'setup_admin', organization_id: ORG }],
     sys_permission_set: [{ id: 'ps_1', name: 'setup_admin', system_permissions: ['setup.access'] }],
 };
 /**
 
@@ -189,12 +189,13 @@ async function mountCloudConnection(opts: {
     const hooks = new Map<string, any>();
     const auth = {
         api: {
-            getSession: async () => (opts.userId ? { user: { id: opts.userId }, session: {} } : null),
+            // The session acts in `o1`, the organization the grant below is owned by.
+            getSession: async () => (opts.userId ? { user: { id: opts.userId }, session: { activeOrganizationId: 'o1' } } : null),
         },
     };
     const grantRows: Record<string, any[]> = opts.userId && opts.setupAccess !== false
         ? {
-            sys_user_permission_set: [{ id: 'ups_1', user_id: opts.userId, permission_set_id: 'ps_1', permission_set: 'setup_admin', organization_id: null }],
+            sys_user_permission_set: [{ id: 'ups_1', user_id: opts.userId, permission_set_id: 'ps_1', permission_set: 'setup_admin', organization_id: 'o1' }],
             sys_permission_set: [{ id: 'ps_1', name: 'setup_admin', system_permissions: ['setup.access'] }],
         }
         : {};