- Shipped
- November 15, 2026 at 5:05 PM UTC
- Author
- Kamo
- Commit
- 958f3aa
Role edits left no trace: the Phase J audit had to rebuild two escalated roles' history from design notes and transcripts. The shared writers now report each role change to optional RoleChangeListener beans: - OrgRoleService (roles API, role templates): created, renamed (title only), rights written (before/after), deleted. - ChildOrgTemplateSeedingService (an organization model re-seeded onto an org's system roles): each role it changed, with the model id. - **************** the three default roles. A change carries right id -> setting before and after (TRUE granted, FALSE denied, absent not specified) and names granted / revoked / denied / undenied. A listener's failure is logged and never reaches the write; no listener, no cost. SecurityService writes them to the access log. Tests: RoleChangeListenerTest 5, **************** 1, **************** 7, GrantAllRolesTest 4.