- Shipped
- August 15, 2026 at 1:19 AM UTC
- Author
- Kamo
- Commit
- 153e47c
Who may operate the platform has been three different answers in three different places — a system_user_access grant table, an owner check copied into each platform controller, and a god-mode flag read as though eligibility were activation. This is one model for all of it: PlatformRightType names each capability, platform_administrator says who holds any, and platform_administrator_right says which, with a timestamp and an author per grant so "who gave this person System User access" has an answer. Deliberately NOT a RoleRightType. Tenant rights say what someone may do inside their organization and are editable from that organization's own settings; these say what someone may do to the platform every organization runs on. The two share a member id and nothing else. PlatformRightsResolver carries the rules — the top-level-org precondition, the owner and god-mode floors — because enforcement lives in more than one service and each identifies its caller differently. Identity stays per service; the verdict does not, so SecurityService and BillingService cannot drift into disagreeing about who runs the platform. Both FK columnDefinitions are pinned so they do not inherit their parents' **************** defaults and orphan every existing row.