- Shipped
- October 28, 2026 at 6:12 AM UTC
- Author
- Kamo
- Commit
- c90387d
TPONBEHALF (owner 2026-10-28), the NO INSUBORDINATION RULE extended: on an authenticated direct order, the SI may use everything the requester can do under their own account (their notifications, mail, calendar, tasks...), with the security of both combined, all the way up its chain of command. - OnBehalfService: the chain of command (anyone above the SI in its reporting line, manager and SI-supervisor edges, transitively, or the org owner; never peers, reports or another SI) and the mint of a short session OF THE REQUESTER (memberID theirs, actorType AI, delegation block SI_ON_BEHALF_OF_MEMBER naming the SI, order and run). Rights = (requester's live rights + the SI's own) less AiRightsFloor and the SI's NUKEs, scoped to the tool's needs; 15 minutes; access-logged. No live session, password or one-time key of the member is used. - POST **************** for the Tool Plane. - GET /api/security/si-on-behalf (mine; scope=org for MANAGE_AI_WORKFORCE / VIEW_ACCESS_LOGS): the append-only si_on_behalf_actions log the Tool Plane writes before each such action. - A delegated session is never widened at mint (a grant-all owner's floor rights never come back) and never counts as the member signed in elsewhere. - DDL **************** (applied).