[Feature] Administer hierarchical View policy and provenance #12

New Issue

2026-08-03T21:10:40+02:00

zemion commented

2026-08-03 21:10:40 +02:00

Goal

Surface the existing system/tenant/group/user View policy engine in administration.

Scope

Inherit/allow/block decisions for view, select, assign, edit, derive, and workflow activation.
Optional allowed-View and visible-surface ceilings.
Searchable View/surface selectors with narrow custom-ID fallback.
Effective state, source path, diagnostics, and removal back to inherited policy.
Group/user target selectors.
Lower scopes may narrow but never broaden ancestor restrictions.

Implementation status

Backend hierarchy, validation, fail-closed behavior, and provenance
System/tenant/group/user administration sections
Action controls and catalogue ceilings
Effective-policy summary and inherited reset
Manifest documentation and surface contributions
Push and deployment verification

## Goal Surface the existing system/tenant/group/user View policy engine in administration. ## Scope - Inherit/allow/block decisions for view, select, assign, edit, derive, and workflow activation. - Optional allowed-View and visible-surface ceilings. - Searchable View/surface selectors with narrow custom-ID fallback. - Effective state, source path, diagnostics, and removal back to inherited policy. - Group/user target selectors. - Lower scopes may narrow but never broaden ancestor restrictions. ## Implementation status - [x] Backend hierarchy, validation, fail-closed behavior, and provenance - [x] System/tenant/group/user administration sections - [x] Action controls and catalogue ceilings - [x] Effective-policy summary and inherited reset - [x] Manifest documentation and surface contributions - [ ] Push and deployment verification

zemion added the module/policy module/views area/governance

area/webui labels 2026-08-03 21:10:40 +02:00

zemion commented

2026-08-03 21:29:54 +02:00

Codex State: progress

Summary

Added system, tenant, group, and user View-policy administration panels with inherited action controls, View/surface ceilings, effective state, and provenance.
The editor prevents attempts to loosen a parent block and constrains selectors to inherited finite ceilings.

Changed Files

webui/src/features/policy/ViewPoliciesPanel.tsx
webui/src/api/viewPolicies.ts
src/govoplan_policy/backend/manifest.py

Verification

All 48 Policy tests, Ruff, WebUI TypeScript, and shared interface-pattern checks passed.

Next / Blocked

Push and run a browser-level hierarchy matrix across system, tenant, group, and user policies.

Suggested status label: status/in-progress

## Codex State: progress ### Summary - Added system, tenant, group, and user View-policy administration panels with inherited action controls, View/surface ceilings, effective state, and provenance. - The editor prevents attempts to loosen a parent block and constrains selectors to inherited finite ceilings. ### Changed Files - `webui/src/features/policy/ViewPoliciesPanel.tsx` - `webui/src/api/viewPolicies.ts` - `src/govoplan_policy/backend/manifest.py` ### Verification - `All 48 Policy tests, Ruff, WebUI TypeScript, and shared interface-pattern checks passed.` ### Next / Blocked - Push and run a browser-level hierarchy matrix across system, tenant, group, and user policies. Suggested status label: `status/in-progress`

zemion commented

2026-08-20 01:25:32 +02:00

Verified the implemented hierarchy and closeout state on current main. Evidence: all 48 Policy backend tests and Ruff pass; system/tenant/group/user hierarchy, narrowing ceilings, provenance, and inherited reset are covered; the Policy interface-pattern suite passes; the shared rendered Playwright conformance suite passes 7/7; and the workspace manifest registry passes 68/68. The implementation was already pushed in fc6d333 and subsequent shared-layout migrations. Closing as complete.

Verified the implemented hierarchy and closeout state on current main. Evidence: all 48 Policy backend tests and Ruff pass; system/tenant/group/user hierarchy, narrowing ceilings, provenance, and inherited reset are covered; the Policy interface-pattern suite passes; the shared rendered Playwright conformance suite passes 7/7; and the workspace manifest registry passes 68/68. The implementation was already pushed in fc6d333 and subsequent shared-layout migrations. Closing as complete.

zemion closed this issue

2026-08-20 01:25:34 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-policy#12