📖About

Build a proper access-control schema in the registry (the SST) and surface it in Heimdall access apps. Standard RBAC shape: principals (agents+humans, with type), artifacts (apps/droids/services/blocks, with artifact_type+owner), a role catalog, a permission/action catalog, role->permission mapping, and principal->role->artifact grants. v1 SEEDS from the CURRENT OWNERSHIP MODEL as the starting point: every artifact owner gets an owner-role grant on that artifact; plus global operator (Orion) and admin (Radagast) roles, and humans from the existing app_access grants. Per-pipeline-phase roles (the shared-surface case) are a deliberate LATER layer the schema is designed to hold. Registry stays the single source of truth - the catalog is derived/idempotently reseeded from existing registry ownership, never a parallel hand-kept list. Replaces the hardcoded per-agent action list in the Agent Access app; the session-open check and the app UI read effective access (principal -> artifact -> actions) from the schema via a shared access_control module.

⚖️Decisions

• Elrond's bypass methodology checklist (a reminder, not a gate -- you've got this): 0. File it requested_mode='bypass' (planner-vs-bypass is a deliberate choice). bypass_start REFUSES a non-bypass initiative (CAROL-INI-1846), and the dispatcher only skips the bypass lane when the mode says bypass -- a 'planner' mistag lets Merlin's pipeline grab the placeholder step and block your finished work. 1. Filed as planned status -- let the bypass claim/activate it; never file active. 2. Open the bypass (bypass_start) with your droid id + the remediation answer (remediates_initiative_id=NNN, or remediates_nothing=True). 3. Work the blocks for your work-type: template -> design -> code -> test -> review. Do the real work; record decisions on the initiative as you make them. 4. Reality is recorded for you at close -- code (files changed), each decision, and the twin-review verdict become real activities tied to this initiative and show in the Activity Tracker like a planner run (CAROL-INI-1840). No dummy rows. 5. Keep the initiative status moving; it parks in 'reviewing' and is tagged uat-pending for you at close (CAROL-INI-1836), so the stuck-watchdog leaves it alone until UAT. 6. Close runs the gates (design/architecture compliance + caller-audit). If a gate flags something pre-existing or unrelated to your change, waive it with a clear written rationale -- audit, don't skip. 7. Bypass skips the planner's auto-orchestration, NOT the standards. Same template checklist, same review, same observability as a planner run. (elrond)
• RBAC schema lives in the registry (SST) as ac_* tables; they are DERIVED and idempotently reseeded from registry ownership by tools/ac_migrate.py, never a parallel hand-kept list. Re-run on ownership changes (nightly resync is a later layer). (orion)
• v1 seeds from the CURRENT OWNERSHIP MODEL: every artifact owner gets the owner role on that artifact (301 grants); plus global operator=Orion and admin=Radagast, and humans from existing app_access. Per-pipeline-phase roles (shared-surface, e.g. file/plan/execute/review) are a deliberate LATER layer the schema already supports. (orion)
• Heimdall access apps + shared renderer now show artifact-scoped access (agent -> surface -> role -> actions) read via shared/access_control.py; replaces the hardcoded per-agent action list. Session-open ENFORCEMENT still uses the legacy list in v1 (needs an action->permission map); migrating it to access_control.can() is the next step. (orion)
• Session gate (approve/reject) is now SCHEMA-DRIVEN: it maps the requested capability-style action to a required permission (ac_action_permissions) and calls access_control.authorize(). With an artifact named it is a precise per-surface check (can()); without one it asks whether the agent holds the permission on any surface (faithful schema-driven equivalent of the old target-less list). Unknown actions are denied by default. The legacy agent_access list + hardcoded RIGHTS are now dead for both display and enforcement. (orion)
• [status-router] planned -> closed | event=operator_put | PUT /api/initiatives (operator)

✅Success criteria

• Registry holds an RBAC schema (principals, artifacts+type, roles, permissions, role->permission, principal->role->artifact grants) seeded idempotently from ownership; access apps show artifact-scoped access; access_control.can() enforces correctly (owner yes, non-owner no, global operator/admin yes) (must_have)