@stigmer/server 3.23.0 → 3.24.0

package/src/authorization/__tests__/fixtures/fga/default-instance-inheritance.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/default-instance-inheritance.fga.yaml
-# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
+# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for default-instance structural inheritance (default_of).
@@ -7,8 +7,8 @@
 # A blueprint's system-managed default instance carries a single
 #   instance#default_of@<blueprint>:<id>
 # tuple and inherits the blueprint's ENTIRE viewer set through
-# `viewer from default_of` — org members, public users (allow_public), and
-# platform users (identity_provider#platform_user). No enum-derived
+# `viewer from default_of` — org members and platform users
+# (identity_provider#platform_user). No enum-derived
 # visibility tuples are ever written on default instances, so their access
 # can never drift from the template's.
 #
@@ -20,8 +20,7 @@
 # visibility level; each has a default instance linked via default_of.
 # Alice (acme member) reaches default instances of platform-shared
 # blueprints; planton members reach default instances of org-visible ones;
-# everyone reaches default instances of public ones; personal instances
-# never leak.
+# personal instances never leak.
 name: default-instance-inheritance
 model_file: ../model/fga.mod
 
@@ -115,35 +114,6 @@ tuples:
     relation: default_of
     object: agent_instance:internal-default
 
-  # --- Public agent + its default instance ---
-  # PUBLIC carries the org floor tuple too (viewer@org#viewer).
-  - user: organization:planton
-    relation: organization
-    object: agent:public-bot
-  - user: identity_account:swarup
-    relation: owner
-    object: agent:public-bot
-  - user: identity_account:*
-    relation: viewer
-    object: agent:public-bot
-    condition:
-      name: allow_public
-  - user: organization:planton#viewer
-    relation: viewer
-    object: agent:public-bot
-  - user: organization:planton
-    relation: organization
-    object: agent_instance:public-bot-default
-  - user: agent:public-bot
-    relation: agent
-    object: agent_instance:public-bot-default
-  - user: identity_account:swarup
-    relation: owner
-    object: agent_instance:public-bot-default
-  - user: agent:public-bot
-    relation: default_of
-    object: agent_instance:public-bot-default
-
   # --- Platform-shared workflow + its default instance ---
   - user: organization:planton
     relation: organization
@@ -175,8 +145,6 @@ tests:
     check:
       - user: identity_account:alice
         object: agent_instance:sara-default
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -187,8 +155,6 @@ tests:
     check:
       - user: identity_account:mallory
         object: agent_instance:sara-default
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -199,14 +165,10 @@ tests:
       # default_of tuple — only she (its owner) can reach it.
       - user: identity_account:swarup
         object: agent_instance:alice-personal
-        context:
-          allow: false
         assertions:
           can_view: false
       - user: identity_account:alice
         object: agent_instance:alice-personal
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -215,8 +177,6 @@ tests:
     check:
       - user: identity_account:priya
         object: agent_instance:internal-default
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -226,34 +186,19 @@ tests:
       # read audience, and the default instance inherits it structurally.
       - user: identity_account:veda
         object: agent_instance:internal-default
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: false
       # Managed-org membership grants nothing on non-platform-shared agents.
       - user: identity_account:alice
         object: agent_instance:internal-default
-        context:
-          allow: false
         assertions:
           can_view: false
 
-  - name: everyone reaches the default instance of a public agent
-    check:
-      - user: identity_account:mallory
-        object: agent_instance:public-bot-default
-        context:
-          allow: true
-        assertions:
-          can_view: true
-
   - name: managed-org member reaches the default instance of a platform-shared workflow
     check:
       - user: identity_account:alice
         object: workflow_instance:onboarding-default
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -263,8 +208,6 @@ tests:
     list_objects:
       - user: identity_account:alice
         type: agent_instance
-        context:
-          allow: false
         assertions:
           can_view:
             - agent_instance:sara-default

package/src/authorization/__tests__/fixtures/fga/mcp-server-authoring.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/mcp-server-authoring.fga.yaml
-# at commit 4c03c38d2 (the OpenFGA store test the cloud runs against its live model).
+# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for MCP-server authoring: an MCP server is an organization's
@@ -88,24 +88,18 @@ tests:
     check:
       - user: identity_account:dave
         object: mcp_server:github
-        context:
-          allow: false
         assertions:
           can_view: true
           can_connect: true
           can_edit: false
       - user: identity_account:vera
         object: mcp_server:github
-        context:
-          allow: false
         assertions:
           can_view: true
           can_connect: true
           can_edit: false
       - user: identity_account:mallory
         object: mcp_server:github
-        context:
-          allow: false
         assertions:
           can_view: false
           can_connect: false
@@ -114,30 +108,22 @@ tests:
     check:
       - user: identity_account:oscar
         object: mcp_server:vault
-        context:
-          allow: false
         assertions:
           can_view: true
           can_connect: true
           can_edit: true
       - user: identity_account:olivia
         object: mcp_server:vault
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
       - user: identity_account:dave
         object: mcp_server:vault
-        context:
-          allow: false
         assertions:
           can_view: false
           can_connect: false
       - user: identity_account:vera
         object: mcp_server:vault
-        context:
-          allow: false
         assertions:
           can_view: false
           can_connect: false

package/src/authorization/__tests__/fixtures/fga/org-admin-owner-inheritance.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/org-admin-owner-inheritance.fga.yaml
-# as changed by stigmer-cloud#757 (the OpenFGA store test the cloud runs against its live model).
+# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for org-admin owner inheritance (T08).
@@ -131,8 +131,6 @@ tests:
     check:
       - user: identity_account:ana
         object: agent:carols-bot
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -169,8 +167,6 @@ tests:
           can_grant_access: true
       - user: identity_account:ana
         object: skill:carols-notes
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -178,8 +174,6 @@ tests:
           can_grant_access: true
       - user: identity_account:ana
         object: workflow:carols-flow
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -197,8 +191,6 @@ tests:
     check:
       - user: identity_account:root
         object: agent:carols-bot
-        context:
-          allow: false
         assertions:
           can_edit: true
           can_delete: true
@@ -218,8 +210,6 @@ tests:
     check:
       - user: identity_account:dave
         object: agent:carols-bot
-        context:
-          allow: false
         assertions:
           can_view: false
           can_edit: false
@@ -250,8 +240,6 @@ tests:
     check:
       - user: identity_account:zara
         object: agent:carols-bot
-        context:
-          allow: false
         assertions:
           can_view: false
           can_edit: false
@@ -266,8 +254,6 @@ tests:
     check:
       - user: identity_account:ana
         object: agent_instance:carols-instance
-        context:
-          allow: false
         assertions:
           can_view: false
           can_edit: false
@@ -297,8 +283,6 @@ tests:
     check:
       - user: identity_account:carol
         object: agent:carols-bot
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -309,8 +293,6 @@ tests:
     list_objects:
       - user: identity_account:ana
         type: agent
-        context:
-          allow: false
         assertions:
           can_view:
             - agent:carols-bot
@@ -318,8 +300,6 @@ tests:
             - agent:carols-bot
       - user: identity_account:ana
         type: agent_instance
-        context:
-          allow: false
         assertions:
           can_view: []
       - user: identity_account:ana

package/src/authorization/__tests__/fixtures/fga/platform-visibility.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/platform-visibility.fga.yaml
-# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
+# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for platform visibility (visibility_platform).
@@ -102,8 +102,6 @@ tests:
     check:
       - user: identity_account:alice
         object: agent:sara
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -112,8 +110,6 @@ tests:
           can_delete: false
       - user: identity_account:bob
         object: agent:sara
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -122,8 +118,6 @@ tests:
     check:
       - user: identity_account:mallory
         object: agent:sara
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -133,8 +127,6 @@ tests:
     check:
       - user: identity_account:priya
         object: agent:sara
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -144,8 +136,6 @@ tests:
       # narrower: platform_user resolves member-from-managed_org.)
       - user: identity_account:veda
         object: agent:sara
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: false
@@ -154,8 +144,6 @@ tests:
     check:
       - user: identity_account:alice
         object: agent:internal-bot
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -163,8 +151,6 @@ tests:
       # without an explicit visibility tuple.
       - user: identity_account:priya
         object: agent:internal-bot
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -173,8 +159,6 @@ tests:
     check:
       - user: identity_account:alice
         object: skill:research
-        context:
-          allow: false
         assertions:
           can_view: true
           can_use: true
@@ -184,8 +168,6 @@ tests:
     check:
       - user: identity_account:alice
         object: workflow:onboarding
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -194,8 +176,6 @@ tests:
     check:
       - user: identity_account:alice
         object: mcp_server:github
-        context:
-          allow: false
         assertions:
           can_view: true
           can_use: true
@@ -205,8 +185,6 @@ tests:
     check:
       - user: identity_account:swarup
         object: agent:sara
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -216,8 +194,6 @@ tests:
     list_objects:
       - user: identity_account:alice
         type: agent
-        context:
-          allow: false
         assertions:
           can_view:
             - agent:sara

package/src/authorization/__tests__/fixtures/fga/workflow-execution-sharing.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/workflow-execution-sharing.fga.yaml
-# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
+# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for workflow_execution sharing and run observability.
@@ -173,8 +173,6 @@ tests:
       # never alice's run history.
       - user: identity_account:vera
         object: workflow_instance:inst1
-        context:
-          allow: false
         assertions:
           can_view: true
       - user: identity_account:vera

package/src/authorization/__tests__/list-read-scope.test.ts

@@ -1,15 +1,15 @@
 /**
  * Pins the built-in list read scope on both store drivers as the twin of
  * the cloud's driver (stigmer-cloud iam/list-read-scope.ts): every
- * candidate a list lane offers is answered by `can_view` under the
- * LISTING context (`allow: false`, the public wildcard suppressed) through
- * the same evaluator the Authorizer uses, over tuples derived from the
- * facts the candidate carries — no candidate row is read twice.
+ * candidate a list lane offers is answered by `can_view` through the same
+ * evaluator the Authorizer uses, over tuples derived from the facts the
+ * candidate carries — no candidate row is read twice.
  *
  * The adversarial cells come first, because until slice 5's sibling
  * cells this file and the composed proof are the only proof that a
- * member's list is a member's list: the outsider sees nothing (a legacy
- * PUBLIC row included); the viewer rung sees the org-visible blueprints
+ * member's list is a member's list: the outsider sees nothing (a row
+ * still carrying the retired public level included); the viewer rung sees
+ * the org-visible blueprints
  * and nothing personal; the founder — an admin — sees the organization's
  * blueprints and NOT its members' sessions, keys, environments or
  * memories (the model's own line, now list-visible); an execution is its session's and
@@ -280,9 +280,10 @@ describe.each(driverFixtures(SEEDED_KINDS))(
           await grant(orgRole(VIEWER, "viewer", ORG));
 
           // Blueprints: the founder's private and org-visible agents, a
-          // member's private one, a legacy PUBLIC one (nobody can set public
-          // under the built-in posture; a row from before it can carry it),
-          // and one stamped by the 3.14 verifiers' raw subject.
+          // member's private one, one still carrying the retired public
+          // level (a row the store migration has not met, which derives no
+          // viewer grant and so reads as its owner's alone), and one
+          // stamped by the 3.14 verifiers' raw subject.
           await save("agent", {
             id: "agt_private",
             org: ORG,
@@ -427,7 +428,7 @@ describe.each(driverFixtures(SEEDED_KINDS))(
         });
 
         describe("the adversarial cells", () => {
-          it("an OUTSIDER lists nothing of the organization's — not even the legacy PUBLIC blueprint, which the listing context suppresses", async () => {
+          it("an OUTSIDER lists nothing of the organization's — a row still carrying the retired public level included", async () => {
             for (const kind of SEEDED_KINDS.filter(
               (k) =>
                 k !== ApiResourceKind.iam_policy &&
@@ -441,13 +442,13 @@ describe.each(driverFixtures(SEEDED_KINDS))(
             }
           });
 
-          it("a VIEWER lists the org-visible and the public blueprints and nothing private; a MEMBER adds their own private one", async () => {
+          it("a VIEWER lists the org-visible blueprint and nothing private; a MEMBER adds their own private one; the retired level grants neither anything", async () => {
             expect(
               await listAs(resolved(VIEWER), ApiResourceKind.agent),
-            ).toEqual(["agt_org", "agt_public"]);
+            ).toEqual(["agt_org"]);
             expect(
               await listAs(resolved(MEMBER), ApiResourceKind.agent),
-            ).toEqual(["agt_org", "agt_member_private", "agt_public"]);
+            ).toEqual(["agt_org", "agt_member_private"]);
           });
 
           it("the FOUNDER and the ADMIN list every blueprint (`owner: … or admin from organization`), including a member's private one", async () => {
@@ -542,7 +543,7 @@ describe.each(driverFixtures(SEEDED_KINDS))(
             const offered = [
               entryOf(
                 ApiResourceKind.agent,
-                rows.get(ApiResourceKind.agent)!.get("agt_public")!,
+                rows.get(ApiResourceKind.agent)!.get("agt_member_private")!,
               ),
               entryOf(
                 ApiResourceKind.agent,
@@ -562,15 +563,15 @@ describe.each(driverFixtures(SEEDED_KINDS))(
               ApiResourceKind.agent,
               offered,
             );
-            expect([...kept]).toEqual(["agt_public", "agt_org"]);
+            expect([...kept]).toEqual(["agt_member_private", "agt_org"]);
             // The lane's order is the lane's: the helper filters its own
             // array by the kept set.
             expect(
               await listAs(resolved(MEMBER), ApiResourceKind.agent, [
-                rows.get(ApiResourceKind.agent)!.get("agt_public")!,
+                rows.get(ApiResourceKind.agent)!.get("agt_member_private")!,
                 rows.get(ApiResourceKind.agent)!.get("agt_org")!,
               ]),
-            ).toEqual(["agt_public", "agt_org"]);
+            ).toEqual(["agt_member_private", "agt_org"]);
           });
 
           it("no candidates: the empty set, with no read of any kind", async () => {

package/src/authorization/__tests__/store-tests.test.ts

@@ -57,7 +57,6 @@ const DOCUMENTS = [
   "channel-app-owner.fga.yaml",
   "channel-participation.fga.yaml",
   "channel-session-visibility.fga.yaml",
-  "cross-org-share-creation.fga.yaml",
   "default-instance-inheritance.fga.yaml",
   "mcp-server-authoring.fga.yaml",
   "memory-subject-only.fga.yaml",
@@ -65,7 +64,6 @@ const DOCUMENTS = [
   "org-shared-environment.fga.yaml",
   "platform-visibility.fga.yaml",
   "provider-standing-viewer.fga.yaml",
-  "public-visibility-setter.fga.yaml",
   "reserved-label-writer.fga.yaml",
   "schedule-owner.fga.yaml",
   "schedule-session-visibility.fga.yaml",
@@ -102,7 +100,7 @@ const SKIPPED_PINNED: ReadonlyArray<string> = [
   "artifact-org-and-owner :: listing reflects org inheritance plus creator ownership :: identity_account:eve <artifact> :: list-objects",
   "artifact-org-and-owner :: listing reflects org inheritance plus creator ownership :: identity_account:victor <artifact> :: list-objects",
   "blueprint-private-visibility :: org admin's listable agents include private ones (T08) :: identity_account:oscar <agent> :: list-objects",
-  "blueprint-private-visibility :: org member's listable agents exclude private ones (wildcard suppressed) :: identity_account:dave <agent> :: list-objects",
+  "blueprint-private-visibility :: org member's listable agents exclude private ones :: identity_account:dave <agent> :: list-objects",
   "blueprint-private-visibility :: org viewer's listable agents are exactly the viewer-shaped org-visible ones :: identity_account:vera <agent> :: list-objects",
   "blueprint-private-visibility :: owner's listable agents include everything they authored :: identity_account:carol <agent> :: list-objects",
   "channel-app-owner :: listing channel apps reflects ownership and grants, not membership :: identity_account:alice <channel_app> :: list-objects",
@@ -132,12 +130,10 @@ const SKIPPED_PINNED: ReadonlyArray<string> = [
   // undeclared-kind: platform
   "provider-standing-viewer :: operator may view provider standing, tenants may not :: identity_account:mallory platform:stigmer :: undeclared-kind",
   "provider-standing-viewer :: operator may view provider standing, tenants may not :: identity_account:opal platform:stigmer :: undeclared-kind",
-  "public-visibility-setter :: operators may set public visibility, tenants may not :: identity_account:machine platform:stigmer :: undeclared-kind",
-  "public-visibility-setter :: operators may set public visibility, tenants may not :: identity_account:mallory platform:stigmer :: undeclared-kind",
-  "public-visibility-setter :: operators may set public visibility, tenants may not :: identity_account:opal platform:stigmer :: undeclared-kind",
   "reserved-label-writer :: operator may write reserved labels, tenants may not :: identity_account:machine platform:stigmer :: undeclared-kind",
   "reserved-label-writer :: operator may write reserved labels, tenants may not :: identity_account:mallory platform:stigmer :: undeclared-kind",
   // undeclared-subject-type: identity_provider#platform_user
+  "agent-instance-creation :: the tenant-family case, the agent half from platform_viewer and the organization half at home :: identity_account:mia can_create_instance agent:open-bot :: undeclared-subject-type (identity_provider)",
   "default-instance-inheritance :: managed-org member reaches the default instance of a platform-shared agent :: identity_account:alice can_execute agent_instance:sara-default :: undeclared-subject-type (identity_provider)",
   "default-instance-inheritance :: managed-org member reaches the default instance of a platform-shared agent :: identity_account:alice can_view agent_instance:sara-default :: undeclared-subject-type (identity_provider)",
   "default-instance-inheritance :: managed-org member reaches the default instance of a platform-shared workflow :: identity_account:alice can_execute workflow_instance:onboarding-default :: undeclared-subject-type (identity_provider)",

package/src/authorization/__tests__/tuples.test.ts

@@ -13,7 +13,7 @@ import {
 } from "../tuples.js";
 
 describe("the string notation", () => {
-  it("parses an object, a userset and the wildcard, and an id may carry a colon (issuer subjects do)", () => {
+  it("parses an object and a userset, and an id may carry a colon (issuer subjects do)", () => {
     expect(parseObjectRef("agent:agt_1")).toEqual({
       type: "agent",
       id: "agt_1",
@@ -27,11 +27,6 @@ describe("the string notation", () => {
       object: { type: "organization", id: "acme" },
       relation: "viewer",
     });
-    expect(parseSubject("identity_account:*")).toEqual({
-      form: "wildcard",
-      type: "identity_account",
-      condition: undefined,
-    });
     expect(parseSubject("identity_account:ida_x")).toEqual({
       form: "object",
       object: { type: "identity_account", id: "ida_x" },
@@ -43,18 +38,24 @@ describe("the string notation", () => {
     expect(() => parseObjectRef(":id")).toThrow("not an object reference");
   });
 
-  it("formats a tuple in the proto's notation, the condition spelled after `with`", () => {
+  it("refuses the wildcard notation — no line of the model admits one", () => {
+    expect(() => parseSubject("identity_account:*")).toThrow(
+      "wildcard subject 'identity_account:*' is not admitted",
+    );
+  });
+
+  it("formats a tuple in the proto's notation", () => {
     expect(
       formatTuple({
         object: parseObjectRef("agent:a"),
         relation: "viewer",
         subject: {
-          form: "wildcard",
-          type: "identity_account",
-          condition: "allow_public",
+          form: "userset",
+          object: { type: "organization", id: "acme" },
+          relation: "viewer",
         },
       }),
-    ).toBe("agent:a#viewer@identity_account:* with allow_public");
+    ).toBe("agent:a#viewer@organization:acme#viewer");
     expect(formatSubject(parseSubject("organization:acme#member"))).toBe(
       "organization:acme#member",
     );

package/src/authorization/authorizer.ts

@@ -17,9 +17,7 @@
  *   2. A kind this edition does not serve is `deny` (`kindServedByEdition`,
  *      the predicate 2b's `checkMyPermission` arm 1 uses, so the console
  *      and the server agree by construction). `platform` is the one that
- *      arrives, through `can_set_public_visibility` — under the built-in
- *      posture nobody sets public visibility, the model's own reason for
- *      making it a platform operator's act.
+ *      can arrive, through an operator capability no self-host holds.
  *   3. The caller as a person (person.ts) and one derived tuple source for
  *      them; the target loaded ONCE through the source's memoised loader,
  *      so the read that decides not-found is the read the derivation
@@ -31,11 +29,9 @@
  *      member cannot learn which account ids exist. Present or exempt, the
  *      row is then evaluated: the cloud asks OpenFGA whether or not the row
  *      exists, and so does this driver.
- *   5. `checkRelation` with the point-check context (`allow: true`: a
- *      public resource reads for any authenticated caller, the cloud's
- *      posture). True is `allow`; false is `deny` with an EMPTY reason, so
- *      the method annotation's byte-pinned `error_msg` wins on the wire,
- *      exactly the cloud's genuine-denial path.
+ *   5. `checkRelation`. True is `allow`; false is `deny` with an EMPTY
+ *      reason, so the method annotation's byte-pinned `error_msg` wins on
+ *      the wire, exactly the cloud's genuine-denial path.
  *
  * Faults. Everything past the pre-checks runs under one guard: a store
  * fault, a person that names nobody (`personFor`), an evaluation fault
@@ -179,7 +175,6 @@ export function newBuiltInAuthorizer(deps: BuiltInAuthorizerDeps): Authorizer {
           object,
           relation,
           person,
-          { allow: true },
         );
         if (allowed) {
           return { kind: "allow" };