GovOPlaN/govoplan-admin
2
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Invalidate tenant entitlements after module changes

Browse Source
This commit is contained in:
zemion
2026-08-04 09:29:35 +02:00
parent 60e2676809
commit e890a90d08
2 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/govoplan_admin/backend/manifest.py
+1 -1
View File
@@ -91,7 +91,7 @@ manifest = ModuleManifest(
title="Govern modules per tenant",
summary="System administrators set each tenant's module ceiling and forced modules; tenant module administrators choose within that ceiling.",
body=(
"Deployment activation installs and loads module code for the whole instance. Tenant module governance is a separate entitlement layer: system administrators mark modules unavailable, available, or forced for a tenant and may also change that tenant's selection. A tenant module administrator can only enable or disable available modules; forced modules and required dependencies remain effective. Module entitlement never grants permissions, and malformed policy fails closed to protected administration modules. Enabling a capability module such as Encryption only makes its services available; data encryption remains an explicit owning-module policy or migration decision."
"Deployment activation installs and loads module code for the whole instance. Tenant module governance is a separate entitlement layer: system administrators mark modules unavailable, available, or forced for a tenant and may also change that tenant's selection. A tenant module administrator can only enable or disable available modules; forced modules and required dependencies remain effective. Module entitlement never grants permissions, and malformed policy fails closed to protected administration modules. Disabling a module stops new API, capability, schedule, and worker admission for that tenant; accepted durable work remains queued and requires an operator decision rather than being executed or discarded. Enabling a capability module such as Encryption only makes its services available; data encryption remains an explicit owning-module policy or migration decision."
),
layer="configured",
documentation_types=("admin",),