Answer product-owner round 1: 0 🔴, 1 🟡 (0 misread); list plugin-settings among the Admin resources

2026-11-09 00:14:53 +01:00
parent 42644ba0f5
commit 1773c2737f
2 changed files with 5 additions and 5 deletions
@@ -347,8 +347,8 @@ curl -X PUT http://keto:4467/admin/relation-tuples -H 'content-type: application
 **A permission's name is authored in plugin code; only its *grants* live in Keto.** A plugin
 declares the permissions it gates on (`permissions:` in the manifest) and the host collects them
 into one catalog — `ctx.declaredPermissions` — which is the fixed list the admin screens offer.
-Nothing in a GUI invents a name; a tuple naming something no installed plugin declares is not
-offered by the admin screens, though a plugin may still gate on it.
+Nothing in a GUI invents a name. A grant of a name that no installed plugin declares still reaches
+the user's JWT, so a plugin may gate on that name without declaring it.

 A change takes effect on the user's **next login or JWT re-mint** (~10 min) — see [Instant
 revoke](#instant-revoke-the-optional-denylist) when you need it sooner.
@@ -35,9 +35,9 @@ screen degrades to a themed 503 rather than crashing. Everything else is an ordi
 folder-discovered, gated per route by its screen's `<resource>:<action>` permission, rendering the
 core building blocks in `views/`.

-Each screen is its own resource — `users`, `groups`, `oauth2-clients` — split into `:read` and
-`:write`, so a helpdesk account can be given `users:read` alone. Holding none of the six hides the
-Admin section entirely.
+Each screen is its own resource — `users`, `groups`, `oauth2-clients`, `plugin-settings` — split
+into `:read` and `:write` (`plugin-settings` has only `:read`), so a helpdesk account can be given
+`users:read` alone. Holding none of the seven hides the Admin section entirely.

 There is **no Permissions screen**. Permission names are declared in plugin code, not created in a
 GUI, so the host's catalog (`ctx.declaredPermissions`) is the fixed list — and holding one is a