[ragnorc]

Summary

A draft RFC, docs/rfcs/2026-10-30-access-authority-views-and-capabilities.md (titled "Access authority: views in the graph"; the filename is fixed by the registry convention), written from first principles for a contributor who has not read anything about permissions and has to judge whether this is the right design.

It decides between, and then combines, the two open permission drafts, #951 (actor views) and #1197 (GQP query contracts and Cedar grants), and reduces the result to the fewest primitives that compose, in four layers:

• Data. Who may see what is edges in the graph: a row's placement in a securable, a principal's membership in a group, and every grant, inheritance, requirement and denial. A securable is whatever node such edges target; a group is whatever a membership edge targets. Nothing declares either.
• Semantics. Six annotations on edge types (@in, @member, @grant, @inherits, @requires, @deny) plus a time window on a property give the edges their meaning. @in has one meaning in three places: on an edge type (the source is placed in the target), on a node type (the row is its own securable, which gives Drive-style item-level control beside containment), on a property (the column is in one fixed securable).
• Enforcement. The engine derives a view per request through one fixed algebra and applies it to every query as a typed plan leaf, to the schema as hidden names, and to search as visible-row statistics. A derived placement column, written in the same publication as the placement edge and verified by repair, is the physical form the filter reads.
• Operations. Cedar decides which actions an actor may perform. Policy groups may be defined from graph groups (members_of); the rules that can change authority (view: all, schema_apply, config_manage) name explicit actors only.

One declaration, view, is the only way a request's view differs from what the graph says: on a rule or on a stored query, per action, with the values all and caller. A stored query is invoked by its name alone (bundle version 2), so a caller can be given an approved computation over data it cannot otherwise see, and view: { read: caller, change: all } lets a body match as the caller and write with reach.

The rule behind it: who may see what is data in the graph; a rule that mentions the caller is a stored query.

The RFC states the goals (G1–G11) from five situations, surveys the design space against them, specifies the design by example, audits every primitive against G11, evaluates a 27-pattern expressiveness ledger (16 direct, 10 by a named modeling step, 1 declined), lists costs and alternatives, and ends with an implementation appendix for agents.

What it changes in the two drafts

• rfc: granular permissioning #951: placement is an edge type marked @in with a derived placement column; securables and groups are derived from the edge types; denial closes downward over inheritance; a principal owns its own securable; the views policy block is replaced by graph-defined policy groups, view on rules and cluster-configured limits; computed placement is dropped for an inheritance edge; the default placement of inserts becomes an explicit edge to $subject; definer-rights stored queries become view on a stored query; Lance citations re-anchor to 13.0.0.
• rfc: query contracts and Cedar grants for agents #1197: per-name invoke_query and the fixed query text as the unit of disclosure survive; the contract language, guard proofs, per-operator obligations, the single-binding fragment, trusted attributes, the submitted mode and the capability binding do not.

Both remain drafts; this RFC supersedes neither. Links to #951 point at its PR because its file is not on main yet.

Revision history

• First revision proposed a separate capability object with its own routes, configuration, contract language and error codes.
• Second revision removed it after an audit against G11 and introduced over, the bridge row and a key-column placement.
• Third revision, after an orthogonality review: placement as a native edge; self-placement; over renamed view, per action, on rules and stored queries only, with the narrowing form and the credential attachment point removed; the bridge row and internal group replaced by graph-defined policy groups; @securable and @computed removed; invocation gated by name alone; error codes reduced to three plus one temporary. The decision log records each step and the alternatives section records why each dropped shape failed.

Checks

• python3 scripts/check-docs.py: OK (438 files)
• typos docs/rfcs/: clean