improvement(auth): unify human delegation with entity owner grants

[mzxchandra]

Summary

Human delegation previously had separate workspace and resource representations. This change uses one SubjectDelegatedPrincipal with an explicit grant and trusted invocation. Workspace and Project grants share owner: { entityType, entityId } with file ownership; discovery, exact two-owner copy, and collection observation retain their specific limits.

• Remove the runtime resource_delegated principal kind. Keep organization delegation and workflow-executor authority separate.
• Use one operation-specific grant factory for Copilot requests. Preserve current permission checks, per-operation Copilot eligibility, invocation checks, and workspace/workflow isolation.
• Adapt legacy workflow V1 payloads, upload bindings, and audit actor formats at the boundaries. No schema or UI/reference-resolution changes.

Type of Change

• Other: authorization model refactor

Testing

• App, auth, and shared testing package type checks; targeted touched-test compilation introduces no diagnostic increases against the repository baseline. Existing baselined test errors remain.
• 1,209 tests across 69 touched non-live suites passed. A subsequent 52-test boundary/codec run covers the final parser and restored admission guard; counts overlap.
• All 143 selected real Postgres/Redis integrations passed across nine suites covering Project discovery, file permissions, uploads, documents, copy, exports, and workspace file versions. Six suites passed initially; the remaining three passed a focused 72-test rerun after correcting stale fixtures and removing concurrent compiler load. Five initial timeout failures passed without increasing timeouts. JSON reports retained.
• Negative control: removing workspace admission protection causes the Project-grant denial test to fail; restoring the guard passes.
• Changed-file Biome and whitespace checks pass. Full repository validation runs in hosted CI.
• Deployed staging and live model/CLI tests are NOT RUN. Staging follow-up covers existing upload/workflow format continuity, workspace and Project Copilot, realtime, organization access, and denial boundaries. No merge or deployment performed.

Checklist

• Code follows project style guidelines
• Self-reviewed authority checks and compatibility projections
• Focused local verification complete
• Hosted CI complete
• Deployed staging verification complete

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 17, 2026 2:56am UTC