You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit 9f5907d
Browse filesBrowse the repository at this point in the historyBrowse files
// #19331 — `delegatable` is declared by PositionSchema and was offered by
36
36
// no control, so the only door to an ADR-0091 D3 self-service delegation
37
37
// was the Source tab's free-text JSON. A boolean node takes the boolean
38
-
// control; the copy states the gate the runtime actually applies.
39
-
{field: 'delegatable',type: 'boolean',colSpan: 1,helpText: 'Holders may delegate this position themselves, time-boxed and with a reason (ADR-0091 D3). Default false — delegation is admin-only.'},
38
+
// control; the copy states the gate the runtime actually applies. The
39
+
// decision record (ADR-0091 D3) stays in this comment, out of the help text.
40
+
{field: 'delegatable',type: 'boolean',colSpan: 1,helpText: 'Holders may delegate this position themselves, time-boxed and with a reason. Default false — delegation is admin-only.'},
// #19331 — four declared keys had no control, so the only door to any of
36
36
// them was the Source tab's free-text JSON. `description` is persisted on
37
37
// sys_permission_set and shown in Setup; the other three are the ADR-0086
38
-
// D3 provenance pair plus the ADR-0090 D5 baseline flag.
38
+
// D3 provenance pair plus the ADR-0090 D5 baseline flag. The help texts
39
+
// are an admin's words; the decision records stay here:
40
+
// - `isDefault` (ADR-0090 D5): an app-level set is auto-bound to the
41
+
// built-in `everyone` position at boot, after the high-privilege check;
42
+
// a package-level set materializes a `sys_audience_binding_suggestion`
43
+
// an admin confirms in Setup.
44
+
// - `managedBy` (ADR-0086 D3): `package` rows are re-seeded on upgrade;
45
+
// `platform` / `user` rows are environment config package seeding
46
+
// never touches.
47
+
// - `packageId` (ADR-0086 D3): a value that disagrees with the package
48
+
// the set ships in or is saved into is refused
49
+
// (`judgePermissionSetOwnerBinding`).
39
50
{field: 'description',type: 'textarea',colSpan: 2,helpText: 'Human-readable description shown in Setup.'},
40
-
{field: 'isDefault',type: 'boolean',colSpan: 1,helpText: 'App baseline for the everyone position (ADR-0090 D5): an app-level set is auto-bound at boot; a package-level set becomes an install-time suggestion an admin confirms. Default false.'},
41
-
{field: 'managedBy',type: 'select',colSpan: 1,helpText: 'Record provenance (ADR-0086 D3): who owns this set across upgrades.',options: [
51
+
{field: 'isDefault',type: 'boolean',colSpan: 1,helpText: 'Gives this set to everyone who signs in, through the built-in everyone position. A set the app itself declares is granted at startup; a set from an installed package becomes a suggestion an admin confirms in Setup. A set with high-privilege permissions is never granted this way. Default false.'},
52
+
{field: 'managedBy',type: 'select',colSpan: 1,helpText: 'Who owns this set: Package means it ships with a package and package upgrades update it; Platform and User mean it was created in this environment and upgrades leave it alone.',options: [
{field: 'packageId',type: 'text',colSpan: 2,helpText: 'Owning package id for a package-shipped set (ADR-0086 D3). Leave empty for an environment-authored set.'},
57
+
{field: 'packageId',type: 'text',colSpan: 2,helpText: 'The package that ships this set; a value naming any other package is refused. Leave empty for a set created in this environment.'},
// touch is rewritten. #23488: the help text names the scope's four
62
73
// live keys only; `manageBindings` and `authorEnvironmentSets` are
63
74
// retired tombstones, not rights a set can grant.
64
-
{field: 'adminScope',widget: 'json',helpText: 'Delegated administration (ADR-0090 D12): lets holders of this set administer one business-unit subtree. businessUnit is the subtree root (sys_business_unit.name) and is required, non-blank; includeSubtree defaults to true; manageAssignments defaults to false and lets the holder assign people to positions, and grant sets directly, inside that subtree; a delegate may hand out only the sets named in assignablePermissionSets. Leave empty for a set that delegates nothing.'},
75
+
{field: 'adminScope',widget: 'json',helpText: 'Delegated administration: lets holders of this set administer one business-unit subtree. businessUnit is the subtree root (sys_business_unit.name) and is required, non-blank; includeSubtree defaults to true; manageAssignments defaults to false and lets the holder assign people to positions, and grant sets directly, inside that subtree; a delegate may hand out only the sets named in assignablePermissionSets. Leave empty for a set that delegates nothing.'},
0 commit comments