feat(permission-groups): enforce every config key server-side - #7313

Closed

waleedlatif1 wants to merge 161 commits into

feat/permission-groups-coverage

Commits on Aug 29, 2026

test(permission-groups): pin config coercion before deriving it
waleedlatif1
committed
f559721
refactor(permission-groups): derive the config from one field registry
waleedlatif1
committed
1230c21
feat(permission-groups): add the capability gate to the authorization funnel
waleedlatif1
committed
d47f5d6
feat(permission-groups): enforce the twelve UI-only keys on the server
waleedlatif1
committed
66cb9c0
fix(permission-groups): close the legacy-block and enrichment bypasses
waleedlatif1
committed
d0ea115
feat(permission-groups): govern personal API keys per group
waleedlatif1
committed
060fc79
feat(permission-groups): govern log export
waleedlatif1
committed
b37d822
chore(docs): publish the permission-group 403 code
waleedlatif1
committed
395d47f
feat(permission-groups): declare the remaining governed capabilities
waleedlatif1
committed
8992e09
fix(permission-groups): gate the MCP route that bypasses its use case
waleedlatif1
committed
25f13a0
fix(permission-groups): gate API-key management, closing the workspace-key escape
waleedlatif1
committed
9aa8fb9
feat(permission-groups): declare capabilities on the remaining resource operations
waleedlatif1
committed
8db1db2
feat(permission-groups): enforce workspace.create, member directory and CLI access
waleedlatif1
committed
9c7800c
feat(permission-groups): enforce the knowledge capabilities
waleedlatif1
committed
724f2e9
merge: annotate operations across mcp, skills, custom tools, catalog and credential groups
waleedlatif1
committed
d4eabdb
feat(permission-groups): enforce tables.create, tables.export and files.bulk_download
waleedlatif1
committed
02b4bca
merge: govern workspace creation, the member directory and CLI access
waleedlatif1
committed
a946ebd
merge: govern knowledge base creation, uploads and connector sources
waleedlatif1
committed
880f24d
feat(permission-groups): annotate workflow operations and close the persist-time block bypass
waleedlatif1
committed
21020ca
merge: govern table creation, table export and bulk file download
waleedlatif1
committed
c76129f
merge: annotate workflow operations and validate blocks at persist time
waleedlatif1
committed
7d4d405
feat(permission-groups): enforce the four declared-but-unwired capabilities
waleedlatif1
committed
dacf676
chore(permission-groups): re-record the settings page module baseline
waleedlatif1
committed
9b2483f
merge: govern execution cost, personal credentials, webhooks and tool auto-approval
waleedlatif1
committed
e36105c
feat(permission-groups): require a capability on every workspace operation
waleedlatif1
committed
015fde2
refactor(permission-groups): one way to ask whether a capability is withheld
waleedlatif1
committed
31cce78
docs(skills): add add-permission-group-item and validate-permission-group-item
waleedlatif1
committed
85975b4
docs(skills): add and validate a permission-group item
waleedlatif1
committed
fa155e3
refactor(permission-groups): remove the count-down mode and settle the module's wording
waleedlatif1
committed
fb3339d
perf(permission-groups): hoist the block-allowlist check out of the save loop
waleedlatif1
committed
10d8e79
refactor(permission-groups): one API for every capability gate
waleedlatif1
committed
a877371
merge: clean the permission-groups module and its audit
waleedlatif1
committed
3466d27
merge: route every capability decision through the shared assertion API
waleedlatif1
committed
2c9c366
fix(permission-groups): stop capabilities refusing workflow runs
waleedlatif1
committed
037b4e9
refactor(permission-groups): keep only the validators that outlive the rules
waleedlatif1
committed
393d9f8
merge: collapse the redundant permission-check validators
waleedlatif1
committed
1d17c78

Commits on Aug 30, 2026

Commits on Aug 31, 2026

Commits on Sep 1, 2026