@zhama/tego-plugin-sdk 0.0.0-stage → 1.36.1

package/access-fixtures/resolve.json

@@ -0,0 +1,1359 @@
+{
+  "description": "Contract cases for the access resolver, shared by the TypeScript and Python SDKs. Each case is the store's rows plus a caller; both runtimes must reach the same permissions and decisions. Only the built-in scopes (own, all) are matched against resources, so neither side needs a plugin evaluator. A hierarchical case's `inheritance.inherit` stands for the plugin's function: it returns the role's grants named in `keep`, plus `add` as written.",
+  "catalog": {
+    "version": 1,
+    "groups": [
+      {
+        "key": "docs",
+        "labelKey": "access.group.docs"
+      },
+      {
+        "key": "admin",
+        "labelKey": "access.group.admin"
+      }
+    ],
+    "scopes": {
+      "own": {
+        "labelKey": "access.scope.own"
+      },
+      "team": {
+        "labelKey": "access.scope.team"
+      },
+      "all": {
+        "labelKey": "access.scope.all"
+      }
+    },
+    "permissions": {
+      "doc.view": {
+        "group": "docs",
+        "labelKey": "access.permission.docView",
+        "scopes": ["own", "team", "all"],
+        "agent": {
+          "requires": ["records.read"]
+        }
+      },
+      "doc.edit": {
+        "group": "docs",
+        "labelKey": "access.permission.docEdit",
+        "scopes": ["own", "team", "all"],
+        "implies": ["doc.view"],
+        "agent": {
+          "requires": ["records.read", "work.prepare"]
+        }
+      },
+      "doc.delete": {
+        "group": "docs",
+        "labelKey": "access.permission.docDelete",
+        "scopes": ["own", "all"]
+      },
+      "report.export": {
+        "group": "docs",
+        "labelKey": "access.permission.reportExport",
+        "agent": {
+          "requires": ["records.read"]
+        }
+      },
+      "settings.edit": {
+        "group": "admin",
+        "labelKey": "access.permission.settingsEdit"
+      }
+    },
+    "menus": {
+      "reports": "report.export",
+      "settings": "settings.edit"
+    },
+    "roles": {
+      "admin": {
+        "nameKey": "access.role.admin",
+        "grants": {
+          "doc.edit": "all",
+          "doc.delete": "all",
+          "report.export": true,
+          "settings.edit": true,
+          "access.manage": true
+        }
+      },
+      "editor": {
+        "nameKey": "access.role.editor",
+        "grants": {
+          "doc.edit": "team",
+          "report.export": true
+        }
+      },
+      "viewer": {
+        "nameKey": "access.role.viewer",
+        "grants": {
+          "doc.view": "own"
+        }
+      }
+    },
+    "hostRoleBindings": {
+      "admin": ["admin"],
+      "super_admin": ["admin"]
+    },
+    "defaults": {
+      "unassigned": "viewer"
+    },
+    "domains": {
+      "project": {
+        "labelKey": "access.domain.project"
+      },
+      "org": {
+        "labelKey": "access.domain.org",
+        "hierarchical": true
+      }
+    },
+    "assignment": {
+      "principals": ["user", "unit", "group"],
+      "maxRolesPerPrincipal": {
+        "project": 1
+      }
+    }
+  },
+  "roles": [
+    {
+      "id": "r-admin",
+      "key": "admin",
+      "builtin": true,
+      "domain": null,
+      "grants": {
+        "doc.edit": "all",
+        "doc.delete": "all",
+        "report.export": true,
+        "settings.edit": true,
+        "access.manage": true
+      }
+    },
+    {
+      "id": "r-editor",
+      "key": "editor",
+      "builtin": true,
+      "domain": null,
+      "grants": {
+        "doc.edit": "team",
+        "report.export": true
+      }
+    },
+    {
+      "id": "r-viewer",
+      "key": "viewer",
+      "builtin": true,
+      "domain": null,
+      "grants": {
+        "doc.view": "own"
+      }
+    },
+    {
+      "id": "r-stale",
+      "key": null,
+      "builtin": false,
+      "domain": null,
+      "grants": {
+        "doc.view": "galaxy",
+        "removed.permission": true,
+        "report.export": "all"
+      }
+    },
+    {
+      "id": "r-project-editor",
+      "key": null,
+      "builtin": false,
+      "domain": {
+        "type": "project",
+        "id": "p1"
+      },
+      "grants": {
+        "doc.edit": "all"
+      }
+    }
+  ],
+  "cases": [
+    {
+      "id": "ACC-C-001",
+      "description": "A user nobody assigned anything holds the default role",
+      "subject": {
+        "userId": "u1",
+        "hostRoles": ["user"]
+      },
+      "assignments": [],
+      "memberships": [],
+      "unassignedRoleId": "r-viewer",
+      "domain": null,
+      "expect": {
+        "permissions": {
+          "doc.view": "own"
+        },
+        "sources": [
+          {
+            "roleId": "r-viewer",
+            "source": "unassigned"
+          }
+        ],
+        "assignedDomains": [],
+        "decisions": [
+          {
+            "permission": "doc.view",
+            "allowed": true,
+            "scope": "own",
+            "reason": "granted"
+          },
+          {
+            "permission": "doc.edit",
+            "allowed": false,
+            "scope": null,
+            "reason": "not_granted"
+          }
+        ]
+      }
+    },
+    {
+      "id": "ACC-C-002",
+      "description": "An explicit assignment replaces the default, and implications carry the scope",
+      "subject": {
+        "userId": "u1",
+        "hostRoles": ["user"]
+      },
+      "assignments": [
+        {
+          "id": "a1",
+          "roleId": "r-editor",
+          "principal": {
+            "kind": "user",
+            "id": "u1",
+            "includeDescendants": false,
+            "unitRoles": null
+          },
+          "domain": null
+        }
+      ],
+      "memberships": [],
+      "unassignedRoleId": "r-viewer",
+      "domain": null,
+      "expect": {
+        "permissions": {
+          "doc.edit": "team",
+          "doc.view": "team",
+          "report.export": true
+        },
+        "sources": [
+          {
+            "roleId": "r-editor",
+            "source": "assignment"
+          }
+        ],
+        "assignedDomains": [],
+        "decisions": [
+          {
+            "permission": "doc.view",
+            "allowed": true,
+            "scope": "team",
+            "reason": "granted"
+          },
+          {
+            "permission": "report.export",
+            "allowed": true,
+            "scope": null,
+            "reason": "granted"
+          }
+        ]
+      }
+    },
+    {
+      "id": "ACC-C-003",
+      "description": "A host administrator holds the bound role on top of the default",
+      "subject": {
+        "userId": "u1",
+        "hostRoles": ["admin"]
+      },
+      "assignments": [],
+      "memberships": [],
+      "unassignedRoleId": "r-viewer",
+      "domain": null,
+      "expect": {
+        "permissions": {
+          "doc.edit": "all",
+          "doc.view": "all",
+          "doc.delete": "all",
+          "report.export": true,
+          "settings.edit": true,
+          "access.manage": true,
+          "access.audit": true
+        },
+        "sources": [
+          {
+            "roleId": "r-admin",
+            "source": "hostRole"
+          },
+          {
+            "roleId": "r-viewer",
+            "source": "unassigned"
+          }
+        ],
+        "assignedDomains": [],
+        "decisions": [
+          {
+            "permission": "access.audit",
+            "allowed": true,
+            "scope": null,
+            "reason": "granted"
+          }
+        ]
+      }
+    },
+    {
+      "id": "ACC-C-004",
+      "description": "Grants from several roles union, the widest scope winning",
+      "subject": {
+        "userId": "u1",
+        "hostRoles": []
+      },
+      "assignments": [
+        {
+          "id": "a1",
+          "roleId": "r-viewer",
+          "principal": {
+            "kind": "user",
+            "id": "u1",
+            "includeDescendants": false,
+            "unitRoles": null
+          },
+          "domain": null
+        },
+        {
+          "id": "a2",
+          "roleId": "r-editor",
+          "principal": {
+            "kind": "group",
+            "id": "g1",
+            "includeDescendants": false,
+            "unitRoles": null
+          },
+          "domain": null
+        }
+      ],
+      "memberships": [
+        {
+          "kind": "group",
+          "id": "g1",
+          "ancestors": []
+        }
+      ],
+      "unassignedRoleId": "r-viewer",
+      "domain": null,
+      "expect": {
+        "permissions": {
+          "doc.view": "team",
+          "doc.edit": "team",
+          "report.export": true
+        },
+        "sources": [
+          {
+            "roleId": "r-viewer",
+            "source": "assignment"
+          },
+          {
+            "roleId": "r-editor",
+            "source": "assignment"
+          }
+        ],
+        "assignedDomains": [],
+        "decisions": [
+          {
+            "permission": "doc.view",
+            "allowed": true,
+            "scope": "team",
+            "reason": "granted"
+          }
+        ]
+      }
+    },
+    {
+      "id": "ACC-C-005",
+      "description": "A unit assignment with descendants reaches a member of a child unit",
+      "subject": {
+        "userId": "u1",
+        "hostRoles": []
+      },
+      "assignments": [
+        {
+          "id": "a1",
+          "roleId": "r-editor",
+          "principal": {
+            "kind": "unit",
+            "id": "unit-root",
+            "includeDescendants": true,
+            "unitRoles": null
+          },
+          "domain": null
+        }
+      ],
+      "memberships": [
+        {
+          "kind": "unit",
+          "id": "unit-child",
+          "ancestors": ["unit-root"],
+          "role": "member"
+        }
+      ],
+      "unassignedRoleId": "r-viewer",
+      "domain": null,
+      "expect": {
+        "permissions": {
+          "doc.edit": "team",
+          "doc.view": "team",
+          "report.export": true
+        },
+        "sources": [
+          {
+            "roleId": "r-editor",
+            "source": "assignment"
+          }
+        ],
+        "assignedDomains": [],
+        "decisions": []
+      }
+    },
+    {
+      "id": "ACC-C-006",
+      "description": "Without descendants a unit assignment does not reach a child unit, so the default applies",
+      "subject": {
+        "userId": "u1",
+        "hostRoles": []
+      },
+      "assignments": [
+        {
+          "id": "a1",
+          "roleId": "r-editor",
+          "principal": {
+            "kind": "unit",
+            "id": "unit-root",
+            "includeDescendants": false,
+            "unitRoles": null
+          },
+          "domain": null
+        }
+      ],
+      "memberships": [
+        {
+          "kind": "unit",
+          "id": "unit-child",
+          "ancestors": ["unit-root"],
+          "role": "member"
+        }
+      ],
+      "unassignedRoleId": "r-viewer",
+      "domain": null,
+      "expect": {
+        "permissions": {
+          "doc.view": "own"
+        },
+        "sources": [
+          {
+            "roleId": "r-viewer",
+            "source": "unassigned"
+          }
+        ],
+        "assignedDomains": [],
+        "decisions": []
+      }
+    },
+    {
+      "id": "ACC-C-007",
+      "description": "A unit assignment limited to unit owners skips an ordinary member",
+      "subject": {
+        "userId": "u1",
+        "hostRoles": []
+      },
+      "assignments": [
+        {
+          "id": "a1",
+          "roleId": "r-editor",
+          "principal": {
+            "kind": "unit",
+            "id": "unit-root",
+            "includeDescendants": false,
+            "unitRoles": ["owner"]
+          },
+          "domain": null
+        }
+      ],
+      "memberships": [
+        {
+          "kind": "unit",
+          "id": "unit-root",
+          "ancestors": [],
+          "role": "member"
+        }
+      ],
+      "unassignedRoleId": null,
+      "domain": null,
+      "expect": {
+        "permissions": {},
+        "sources": [],
+        "assignedDomains": [],
+        "decisions": [
+          {
+            "permission": "doc.view",
+            "allowed": false,
+            "scope": null,
+            "reason": "not_granted"
+          }
+        ]
+      }
+    },
+    {
+      "id": "ACC-C-008",
+      "description": "A digital employee keeps only what each permission's agent policy and the delegation allow",
+      "subject": {
+        "userId": "u1",
+        "hostRoles": ["admin"],
+        "agent": {
+          "avatarId": "av1",
+          "delegation": ["records.read"]
+        }
+      },
+      "assignments": [],
+      "memberships": [],
+      "unassignedRoleId": null,
+      "domain": null,
+      "expect": {
+        "permissions": {
+          "doc.view": "all",
+          "report.export": true
+        },
+        "sources": [
+          {
+            "roleId": "r-admin",
+            "source": "hostRole"
+          }
+        ],
+        "assignedDomains": [],
+        "decisions": [
+          {
+            "permission": "doc.view",
+            "allowed": true,
+            "scope": "all",
+            "reason": "granted"
+          },
+          {
+            "permission": "doc.edit",
+            "allowed": false,
+            "scope": null,
+            "reason": "delegation_missing"
+          },
+          {
+            "permission": "doc.delete",
+            "allowed": false,
+            "scope": null,
+            "reason": "agent_forbidden"
+          },
+          {
+            "permission": "access.manage",
+            "allowed": false,
+            "scope": null,
+            "reason": "agent_forbidden"
+          }
+        ]
+      }
+    },
+    {
+      "id": "ACC-C-009",
+      "description": "A domain assignment counts only in its domain; elsewhere the default applies",
+      "subject": {
+        "userId": "u1",
+        "hostRoles": []
+      },
+      "assignments": [
+        {
+          "id": "a1",
+          "roleId": "r-project-editor",
+          "principal": {
+            "kind": "user",
+            "id": "u1",
+            "includeDescendants": false,
+            "unitRoles": null
+          },
+          "domain": {
+            "type": "project",
+            "id": "p1"
+          }
+        }
+      ],
+      "memberships": [],
+      "unassignedRoleId": "r-viewer",
+      "domain": null,
+      "expect": {
+        "permissions": {
+          "doc.view": "own"
+        },
+        "sources": [
+          {
+            "roleId": "r-viewer",
+            "source": "unassigned"
+          }
+        ],
+        "assignedDomains": [
+          {
+            "type": "project",
+            "id": "p1"
+          }
+        ],
+        "decisions": []
+      }
+    },
+    {
+      "id": "ACC-C-010",
+      "description": "Inside the domain, the domain assignment applies and the default does not",
+      "subject": {
+        "userId": "u1",
+        "hostRoles": []
+      },
+      "assignments": [
+        {
+          "id": "a1",
+          "roleId": "r-project-editor",
+          "principal": {
+            "kind": "user",
+            "id": "u1",
+            "includeDescendants": false,
+            "unitRoles": null
+          },
+          "domain": {
+            "type": "project",
+            "id": "p1"
+          }
+        }
+      ],
+      "memberships": [],
+      "unassignedRoleId": "r-viewer",
+      "domain": {
+        "type": "project",
+        "id": "p1"
+      },
+      "expect": {
+        "permissions": {
+          "doc.edit": "all",
+          "doc.view": "all"
+        },
+        "sources": [
+          {
+            "roleId": "r-project-editor",
+            "source": "assignment"
+          }
+        ],
+        "assignedDomains": [
+          {
+            "type": "project",
+            "id": "p1"
+          }
+        ],
+        "decisions": []
+      }
+    },
+    {
+      "id": "ACC-C-011",
+      "description": "A global assignment applies inside every domain",
+      "subject": {
+        "userId": "u1",
+        "hostRoles": []
+      },
+      "assignments": [
+        {
+          "id": "a1",
+          "roleId": "r-editor",
+          "principal": {
+            "kind": "user",
+            "id": "u1",
+            "includeDescendants": false,
+            "unitRoles": null
+          },
+          "domain": null
+        }
+      ],
+      "memberships": [],
+      "unassignedRoleId": "r-viewer",
+      "domain": {
+        "type": "project",
+        "id": "p2"
+      },
+      "expect": {
+        "permissions": {
+          "doc.edit": "team",
+          "doc.view": "team",
+          "report.export": true
+        },
+        "sources": [
+          {
+            "roleId": "r-editor",
+            "source": "assignment"
+          }
+        ],
+        "assignedDomains": [],
+        "decisions": []
+      }
+    },
+    {
+      "id": "ACC-C-012",
+      "description": "Grants the catalog no longer recognises are ignored, never widened",
+      "subject": {
+        "userId": "u1",
+        "hostRoles": []
+      },
+      "assignments": [
+        {
+          "id": "a1",
+          "roleId": "r-stale",
+          "principal": {
+            "kind": "user",
+            "id": "u1",
+            "includeDescendants": false,
+            "unitRoles": null
+          },
+          "domain": null
+        }
+      ],
+      "memberships": [],
+      "unassignedRoleId": "r-viewer",
+      "domain": null,
+      "expect": {
+        "permissions": {},
+        "sources": [
+          {
+            "roleId": "r-stale",
+            "source": "assignment"
+          }
+        ],
+        "assignedDomains": [],
+        "decisions": [
+          {
+            "permission": "report.export",
+            "allowed": false,
+            "scope": null,
+            "reason": "not_granted"
+          }
+        ]
+      }
+    },
+    {
+      "id": "ACC-C-013",
+      "description": "Resource checks: own matches only the caller's resource; all matches any",
+      "subject": {
+        "userId": "u1",
+        "hostRoles": []
+      },
+      "assignments": [],
+      "memberships": [],
+      "unassignedRoleId": "r-viewer",
+      "domain": null,
+      "expect": {
+        "permissions": {
+          "doc.view": "own"
+        },
+        "sources": [
+          {
+            "roleId": "r-viewer",
+            "source": "unassigned"
+          }
+        ],
+        "assignedDomains": [],
+        "decisions": [
+          {
+            "permission": "doc.view",
+            "resource": {
+              "ownerId": "u1"
+            },
+            "allowed": true,
+            "scope": "own",
+            "matchedScope": "own",
+            "reason": "granted"
+          },
+          {
+            "permission": "doc.view",
+            "resource": {
+              "ownerId": "u2"
+            },
+            "allowed": false,
+            "scope": "own",
+            "reason": "scope_mismatch"
+          },
+          {
+            "permission": "doc.edit",
+            "resource": {
+              "ownerId": "u1"
+            },
+            "allowed": false,
+            "scope": null,
+            "reason": "not_granted"
+          }
+        ]
+      }
+    },
+    {
+      "id": "ACC-C-014",
+      "description": "The widest held scope matches first",
+      "subject": {
+        "userId": "u1",
+        "hostRoles": ["super_admin"]
+      },
+      "assignments": [],
+      "memberships": [],
+      "unassignedRoleId": null,
+      "domain": null,
+      "expect": {
+        "permissions": {
+          "doc.edit": "all",
+          "doc.view": "all",
+          "doc.delete": "all",
+          "report.export": true,
+          "settings.edit": true,
+          "access.manage": true,
+          "access.audit": true
+        },
+        "sources": [
+          {
+            "roleId": "r-admin",
+            "source": "hostRole"
+          }
+        ],
+        "assignedDomains": [],
+        "decisions": [
+          {
+            "permission": "doc.delete",
+            "resource": {
+              "ownerId": "u2"
+            },
+            "allowed": true,
+            "scope": "all",
+            "matchedScope": "all",
+            "reason": "granted"
+          }
+        ]
+      }
+    },
+    {
+      "id": "ACC-C-015",
+      "description": "In a hierarchical domain, an ancestor's assignment applies through inherit, and adds to the default",
+      "subject": {
+        "userId": "u1",
+        "hostRoles": ["user"]
+      },
+      "assignments": [
+        {
+          "id": "a1",
+          "roleId": "r-editor",
+          "principal": {
+            "kind": "user",
+            "id": "u1",
+            "includeDescendants": false,
+            "unitRoles": null
+          },
+          "domain": {
+            "type": "org",
+            "id": "o1"
+          }
+        }
+      ],
+      "memberships": [],
+      "unassignedRoleId": "r-viewer",
+      "domain": {
+        "type": "org",
+        "id": "o3"
+      },
+      "inheritance": {
+        "ancestors": [
+          {
+            "type": "org",
+            "id": "o2"
+          },
+          {
+            "type": "org",
+            "id": "o1"
+          }
+        ],
+        "inherit": {
+          "keep": ["doc.view"],
+          "add": {}
+        }
+      },
+      "expect": {
+        "permissions": {
+          "doc.view": "team"
+        },
+        "sources": [
+          {
+            "roleId": "r-editor",
+            "source": "assignment",
+            "inherited": true
+          },
+          {
+            "roleId": "r-viewer",
+            "source": "unassigned"
+          }
+        ],
+        "assignedDomains": [
+          {
+            "type": "org",
+            "id": "o1"
+          }
+        ],
+        "decisions": [
+          {
+            "permission": "doc.view",
+            "allowed": true,
+            "scope": "team",
+            "reason": "granted"
+          },
+          {
+            "permission": "doc.edit",
+            "allowed": false,
+            "scope": null,
+            "reason": "not_granted"
+          },
+          {
+            "permission": "report.export",
+            "allowed": false,
+            "scope": null,
+            "reason": "not_granted"
+          }
+        ]
+      }
+    },
+    {
+      "id": "ACC-C-016",
+      "description": "Inherit can only narrow: what it adds beyond the role is dropped, and a widened scope falls back to the role's",
+      "subject": {
+        "userId": "u1",
+        "hostRoles": ["user"]
+      },
+      "assignments": [
+        {
+          "id": "a1",
+          "roleId": "r-editor",
+          "principal": {
+            "kind": "user",
+            "id": "u1",
+            "includeDescendants": false,
+            "unitRoles": null
+          },
+          "domain": {
+            "type": "org",
+            "id": "o1"
+          }
+        }
+      ],
+      "memberships": [],
+      "unassignedRoleId": null,
+      "domain": {
+        "type": "org",
+        "id": "o3"
+      },
+      "inheritance": {
+        "ancestors": [
+          {
+            "type": "org",
+            "id": "o2"
+          },
+          {
+            "type": "org",
+            "id": "o1"
+          }
+        ],
+        "inherit": {
+          "keep": [],
+          "add": {
+            "doc.edit": "all",
+            "settings.edit": true
+          }
+        }
+      },
+      "expect": {
+        "permissions": {
+          "doc.edit": "team",
+          "doc.view": "team"
+        },
+        "sources": [
+          {
+            "roleId": "r-editor",
+            "source": "assignment",
+            "inherited": true
+          }
+        ],
+        "assignedDomains": [
+          {
+            "type": "org",
+            "id": "o1"
+          }
+        ],
+        "decisions": [
+          {
+            "permission": "doc.edit",
+            "allowed": true,
+            "scope": "team",
+            "reason": "granted"
+          },
+          {
+            "permission": "settings.edit",
+            "allowed": false,
+            "scope": null,
+            "reason": "not_granted"
+          }
+        ]
+      }
+    },
+    {
+      "id": "ACC-C-017",
+      "description": "An assignment at a domain off the ancestor line does not reach in, so the default applies",
+      "subject": {
+        "userId": "u1",
+        "hostRoles": ["user"]
+      },
+      "assignments": [
+        {
+          "id": "a1",
+          "roleId": "r-editor",
+          "principal": {
+            "kind": "user",
+            "id": "u1",
+            "includeDescendants": false,
+            "unitRoles": null
+          },
+          "domain": {
+            "type": "org",
+            "id": "o9"
+          }
+        }
+      ],
+      "memberships": [],
+      "unassignedRoleId": "r-viewer",
+      "domain": {
+        "type": "org",
+        "id": "o3"
+      },
+      "inheritance": {
+        "ancestors": [
+          {
+            "type": "org",
+            "id": "o2"
+          },
+          {
+            "type": "org",
+            "id": "o1"
+          }
+        ],
+        "inherit": {
+          "keep": ["doc.view"],
+          "add": {}
+        }
+      },
+      "expect": {
+        "permissions": {
+          "doc.view": "own"
+        },
+        "sources": [
+          {
+            "roleId": "r-viewer",
+            "source": "unassigned"
+          }
+        ],
+        "assignedDomains": [
+          {
+            "type": "org",
+            "id": "o9"
+          }
+        ],
+        "decisions": [
+          {
+            "permission": "doc.view",
+            "allowed": true,
+            "scope": "own",
+            "reason": "granted"
+          }
+        ]
+      }
+    },
+    {
+      "id": "ACC-C-018",
+      "description": "A direct assignment and an inherited one union; the direct one is not narrowed",
+      "subject": {
+        "userId": "u1",
+        "hostRoles": ["user"]
+      },
+      "assignments": [
+        {
+          "id": "a1",
+          "roleId": "r-viewer",
+          "principal": {
+            "kind": "user",
+            "id": "u1",
+            "includeDescendants": false,
+            "unitRoles": null
+          },
+          "domain": {
+            "type": "org",
+            "id": "o3"
+          }
+        },
+        {
+          "id": "a2",
+          "roleId": "r-admin",
+          "principal": {
+            "kind": "user",
+            "id": "u1",
+            "includeDescendants": false,
+            "unitRoles": null
+          },
+          "domain": {
+            "type": "org",
+            "id": "o2"
+          }
+        }
+      ],
+      "memberships": [],
+      "unassignedRoleId": null,
+      "domain": {
+        "type": "org",
+        "id": "o3"
+      },
+      "inheritance": {
+        "ancestors": [
+          {
+            "type": "org",
+            "id": "o2"
+          },
+          {
+            "type": "org",
+            "id": "o1"
+          }
+        ],
+        "inherit": {
+          "keep": ["doc.view", "report.export"],
+          "add": {}
+        }
+      },
+      "expect": {
+        "permissions": {
+          "doc.view": "all",
+          "report.export": true
+        },
+        "sources": [
+          {
+            "roleId": "r-viewer",
+            "source": "assignment"
+          },
+          {
+            "roleId": "r-admin",
+            "source": "assignment",
+            "inherited": true
+          }
+        ],
+        "assignedDomains": [
+          {
+            "type": "org",
+            "id": "o3"
+          },
+          {
+            "type": "org",
+            "id": "o2"
+          }
+        ],
+        "decisions": [
+          {
+            "permission": "doc.view",
+            "allowed": true,
+            "scope": "all",
+            "reason": "granted"
+          },
+          {
+            "permission": "access.manage",
+            "allowed": false,
+            "scope": null,
+            "reason": "not_granted"
+          }
+        ]
+      }
+    },
+    {
+      "id": "ACC-C-019",
+      "description": "At the ancestor itself the role applies whole: inherit governs only what passes down",
+      "subject": {
+        "userId": "u1",
+        "hostRoles": ["user"]
+      },
+      "assignments": [
+        {
+          "id": "a1",
+          "roleId": "r-editor",
+          "principal": {
+            "kind": "user",
+            "id": "u1",
+            "includeDescendants": false,
+            "unitRoles": null
+          },
+          "domain": {
+            "type": "org",
+            "id": "o1"
+          }
+        }
+      ],
+      "memberships": [],
+      "unassignedRoleId": "r-viewer",
+      "domain": {
+        "type": "org",
+        "id": "o1"
+      },
+      "inheritance": {
+        "ancestors": [],
+        "inherit": {
+          "keep": ["doc.view"],
+          "add": {}
+        }
+      },
+      "expect": {
+        "permissions": {
+          "doc.edit": "team",
+          "doc.view": "team",
+          "report.export": true
+        },
+        "sources": [
+          {
+            "roleId": "r-editor",
+            "source": "assignment"
+          }
+        ],
+        "assignedDomains": [
+          {
+            "type": "org",
+            "id": "o1"
+          }
+        ],
+        "decisions": [
+          {
+            "permission": "report.export",
+            "allowed": true,
+            "scope": null,
+            "reason": "granted"
+          }
+        ]
+      }
+    },
+    {
+      "id": "ACC-C-020",
+      "description": "An ancestor's role that inherit passes nothing of does not reach below: it is no source, and the default applies",
+      "subject": {
+        "userId": "u1",
+        "hostRoles": ["user"]
+      },
+      "assignments": [
+        {
+          "id": "a1",
+          "roleId": "r-editor",
+          "principal": {
+            "kind": "user",
+            "id": "u1",
+            "includeDescendants": false,
+            "unitRoles": null
+          },
+          "domain": {
+            "type": "org",
+            "id": "o1"
+          }
+        }
+      ],
+      "memberships": [],
+      "unassignedRoleId": "r-viewer",
+      "domain": {
+        "type": "org",
+        "id": "o3"
+      },
+      "inheritance": {
+        "ancestors": [
+          {
+            "type": "org",
+            "id": "o2"
+          },
+          {
+            "type": "org",
+            "id": "o1"
+          }
+        ],
+        "inherit": {
+          "keep": [],
+          "add": {}
+        }
+      },
+      "expect": {
+        "permissions": {
+          "doc.view": "own"
+        },
+        "sources": [
+          {
+            "roleId": "r-viewer",
+            "source": "unassigned"
+          }
+        ],
+        "assignedDomains": [
+          {
+            "type": "org",
+            "id": "o1"
+          }
+        ],
+        "decisions": [
+          {
+            "permission": "doc.edit",
+            "allowed": false,
+            "scope": null,
+            "reason": "not_granted"
+          }
+        ]
+      }
+    },
+    {
+      "id": "ACC-C-021",
+      "description": "A default role holding access.manage — a built-in the catalog changed after the tenant chose it — confers everything but managing access",
+      "subject": {
+        "userId": "u1",
+        "hostRoles": ["user"]
+      },
+      "assignments": [],
+      "memberships": [],
+      "unassignedRoleId": "r-admin",
+      "domain": null,
+      "expect": {
+        "permissions": {
+          "doc.edit": "all",
+          "doc.view": "all",
+          "doc.delete": "all",
+          "report.export": true,
+          "settings.edit": true
+        },
+        "sources": [
+          {
+            "roleId": "r-admin",
+            "source": "unassigned"
+          }
+        ],
+        "assignedDomains": [],
+        "decisions": [
+          {
+            "permission": "access.manage",
+            "allowed": false,
+            "scope": null,
+            "reason": "not_granted"
+          },
+          {
+            "permission": "access.audit",
+            "allowed": false,
+            "scope": null,
+            "reason": "not_granted"
+          },
+          {
+            "permission": "settings.edit",
+            "allowed": true,
+            "scope": null,
+            "reason": "granted"
+          }
+        ]
+      }
+    }
+  ]
+}