- Shipped
- August 21, 2026 at 10:28 PM UTC
- Author
- kamo
- Commit
- 3c54ab8
Rules are an ordered list over ordered member pairs; the first match decides, so every verdict names exactly one rule and the UI can always explain itself. Selectors cover departments (with the sub-department tree), job titles, members, member type and work location; qualifiers cover the relative predicates that selectors cannot express -- same department, different manager, in my chain. Group chats get no policy axis of their own: the invite gate is the DM gate. A room is shared context, so the only check is that whoever adds a member is allowed to DM them. A room that shrinks back to two denied members re-evaluates as a DM and freezes, which is the only bypass that model leaves open. Records two defects found on the feature's path and folded into it: the message send endpoint never checks session membership, and the directory route the add -members picker calls does not exist.