- Shipped
- August 21, 2026 at 11:46 PM UTC
- Author
- Kamo
- Commit
- 85b6607
Decides whether one member may open a conversation with another, and whether they may send into one that exists. Rules are an ordered list over ordered pairs and the first match decides, so every verdict names exactly one rule -- which is what lets the settings UI explain itself instead of asking an administrator to trust it. The orientation rule is the load-bearing part. A rule written SUBJECT -> TARGET is evaluated from both ends: forward the actor is the side it is written from, reverse the side it is written about. Without that, "Sales may message Engineering one-way" would match when a salesperson acts and fall through to whatever sits below when an engineer does -- doing nothing in the only direction it exists to restrict. Absence is never agreement. A department, title or manager clause cannot match a plain Member, and inapplicability short-circuits ahead of negation, so "not in Sales" does not sweep in every subscriber who has no department at all. The evaluator holds no repository and opens no session: two queries build a per-org snapshot, and every verdict after that is set arithmetic. Resolving a manager chain through JPA would have been a query per link per member at unbounded depth, on a path that runs whenever a cache goes cold.