giles 9261d69cc5 acl: Phase 2 inheritance (groups, resource trees, roles) + 30 tests ...

eff_grant/eff_deny derived relations inherit through member_of (group +
role membership) and child_of (resource hierarchy); role_grant confers
role capabilities. Deny-overrides via stratified negation, deny
authoritative across the inheritance closure. Cyclic membership
terminates. Phase 1 suite unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-06 16:36:24 +00:00

8.3 KiB

Raw Blame History

View Raw