Protect owner administration authority

2026-09-04 00:20:28 -04:00
parent 6f0b597943
commit d54d6a4ad1
10 changed files with 100 additions and 7 deletions
@@ -73,3 +73,9 @@ application concern belongs in the shared module.
  and writes identity plus organization audits. Grant completion installs the
  replacement password, passkey, and recovery-code set atomically and never
  issues a session.
+- Gamertan's distinction between Site Admin and Owner exposed a second
+  composition boundary: permission to manage ordinary staff must not imply
+  permission to create, demote, suspend, or remove an Owner. Preview 19 moves
+  that invariant into the same SQLite transactions as direct-role and
+  membership changes, while leaving the application's role vocabulary and UI
+  policy application-owned.