- Shipped
- July 7, 2026 at 5:31 AM UTC
- Author
- Kamo
- Commit
- 5f20d29
Effective rights were computed by folding every source (roles, department, job title, member) into one map where NUKE always won. That meant a member holding both an "Administrator (Full Access)" role and a base "Team Members" role that NUKEs some rights lost those rights entirely — the deny could never be overridden — which is why full-access admins saw only a subset of their settings. Rights now resolve in layers, least- to most-specific, each overriding the previous for any right it sets explicitly (GRANTED or NUKE symmetric): Security Model (non-force baseline) -> Security Roles -> Department -> Job Title -> Member Profile -> Security Model FORCE (absolute) A Department NUKE is overridable by a Job Title GRANT; the Member Profile beats every earlier layer; only a Security Model FORCE_NUKE/FORCE_GRANTED holds all the way down. Within a single layer (e.g. several roles) peers have no ordering, so an explicit GRANTED wins over an explicit NUKE — a deny that must survive is placed one layer up or as a model FORCE_NUKE. Removes the old NUKE-always-wins combiner.