Fullsend

Appearance

151. Use harness human-role minimums for actor admission ​

Date: 2026-10-23

Status ​

Accepted

This decision applies only to CEL/entity routes and migrated v2 model-bound admission. Legacy non-CEL, non-entity workflows remain under Authorization v1 and their existing workflow guards.

Earlier ADREffect of this decision
ADR 0054Apply the harness minimum before CEL on migrated routes.
ADR 0098Apply it to decisive actor-attributed entity facts.
ADR 0133 and ADR 0141Apply it at model-record admission and exposure gates.
ADR 0061Resolve the minimum before the harness actor gate and CEL.
ADR 0107A human label grant meets triage only; bots remain separate.

Context ​

ADR 0061 puts platform authorization before harness CEL. Authorization v1 sets different human thresholds for observation and mutation routes, while a harness's role selects its run credentials. Credential scope does not decide which people may trigger a harness or contribute actor-authored data to it. A single triage threshold could let lower-privilege actors influence a write-capable harness. A per-harness minimum addresses that gap; its trusted value must be resolved before it gates admission. ADR 0112 allows trusted-fact-guarded overlays to set such fields.

Options ​

Keep one triage threshold for every harness and rely on CEL for stricter routing; derive a threshold from token permissions; or use an explicit default mapping from mint role with a configurable, platform-enforced harness minimum.

Decision ​

  1. Fullsend enforces a non-waivable triage floor for ordinary human actors. Bots use their separate registered-role and label-handoff rules.
  2. Each harness has an effective human_min_role. It defaults to triage for role: triage or role: review, and to write for every other role, including custom roles. An explicit value may be triage, write, maintain, or admin; an invalid value makes the harness ineligible.
  3. Trusted top-level values and guarded overlays may set the minimum. An overlay may preserve or lower its layer's non-overlay baseline, never raise it. A missing optional guard keeps the baseline; unverifiable required evidence or an evaluation error fails closed. CEL and deprecated forge: blocks cannot set or relax the minimum.
  4. The same effective minimum gates the human prompting event, decisive actor-originated entity facts, and Fullsend-controlled model-bound records. CEL may narrow admission further but cannot relax these gates.
  5. A verified human label addition grants triage only for its exact accepted transition and proven projection. It does not create a verified role; a stronger harness minimum requires the labeler's verified effective role.

Authorization Contract v2 defines the policy sources, overlay-resolution and provenance rules, per-record gates, auditing, and run-time rechecks. ADR 0144 defines the bound-run lifecycle. These v2 rules do not extend to legacy non-CEL, non-entity workflows.

Forge scope ​

GitHub, GitLab, and Jira use their verified normalized-role mappings. Jira Developer and Administrator satisfy triage because Jira has no separate triage level. Forgejo must provide a verified effective role or deny the role-based path. Bot and label grants require separate provider evidence.

Consequences ​

  • The human_min_role field is target behavior until the loader validates and enforces it. Existing legacy routes keep their Authorization v1 guards.
  • A harness author may deliberately set human_min_role: triage for a write-capable role; that permits triage actors and records to guide that harness without changing its minted capabilities.
  • Each harness applies its own minimum to shared verified role evidence; authorization decisions and filtered views are not shared across minima.
  • Entity-context-snapshot v1 retains its observation/mutation-derived triage/write threshold. A different snapshot threshold requires a versioned contract.