datatug / datatug-core / 41865888766

100%

push

github

feat(dataaccess): agents hold their own approvals, capped by their user (#450)

Perimeter AI-agent access, part 1 (D23, D27, D28), Core only. Plan: side-session notes `perimeter-agent-access-part1-plan.md`.

- **Agents hold their own approvals.** The blanket `BINDING_MISMATCH` for any grant on an agent (`authority.go:168`) is narrowed: an agent may present grants whose subject is that agent and whose `agentUser` is the person it belongs to. Human grants never reach an agent; agent grants never reach a human; every other binding check stays.
- **Agent ⊆ user, at every authorization.** Every agent `Resolution` carries its user's fresh resolution (`agentUser`, same `ServerTime`, no longer validity). Core intersects the two read policies per table (never a union); a read the agent's own perimeter admits but its user's does not is refused with `AGENT_USER_LACKS_ACCESS`. The user's resolution (identity and access) is part of the lease digest. `InspectTableRead` is capped the same way.
- **Host helpers.** `ProjectAgentResolution` builds the agent resolution (through the sealed exact snapshot when one applies); `Covers` answers whether a person can read a scope now, with the same admission as a read, for own-agent decisions and dormancy.
- **Wire.** `Grant.agentUser`, `forwarded`, `effectiveAt`; `Decision.forOwnAgent`, `dormant`, `byAgentUser`; validated so they appear only on agent grants, an agent never decides, and the user's own decision is always flagged.

Rows and fields: MVP grants carry no record or field scope, so per-table is the complete intersection today; the seam is `operationReadPolicy.intersect`, where DAS L3 field units join.

Breaking for hosts: an agent resolution without `agentUser` is now refused. backend/datatug-cloud adopt this in the same round before bumping.

Review: three adversarial rounds, final APPROVE (Reviewed-Head: 0d80e5498). 100% statement coverage of `pkg/dataaccess`.

🤖 Generated with [Claude... (continued)

207 of 207 new or added lines in 8 files covered. (100.0%)

39003 of 39003 relevant lines covered (100.0%)

1.0 hits per line