- Ya
- 12 Agosti 2026, 02:08 UTC
- Mwandishi
- Kamo
- Ahadi ya
- ad905f5
Split so separation of duties is expressible: whoever approves a timecard is not automatically whoever may close a pay period over it. MANAGE_TIMECARDS (183) stays the module gate and is deliberately neither. Enrollment is still NOT a right -- it is a persisted employment fact. A right leaks ON through four shipped behaviours and vanishes from a TERMINATED member exactly when HR must produce their final timecard. Deliberately absent from NEW_RIGHT_SEEDS: that carries an EXISTING grant forward, and these gate a capability nobody had. Adding a right needs only a SecurityService restart -- no KamoInitializer pass, no DDL. Ids pinned by a test, because the id is what member_rights_applied stores.