A narrow role whose few rows are all GRANTED is not grant-all (MS phase I)

Shipped

November 15, 2026 at 5:58 AM UTC

Author

Kamo

Commit

d3bf4cf

GrantAllRoles.isGrantAllRole called a role grant-all when every row it had was GRANTED, without checking it had a row for every right. The roles API keeps only the rows it is sent **************** so a role saved as "Underwrite Mortgage Loan" alone had 2 rows, both GRANTED - and its members signed in holding all 463 rights (found live on the lab org while checking an underwriter-only member). Grant-all now means a GRANTED row for every RoleRightType, or the organization's Administrator role (the one role that inherits a right added after its rows were written). Only that one lab role had the short shape in production; every full-access role is unchanged.