From ac2232c98d48f508f9f2fa4a844d9a4b4bfb044a Mon Sep 17 00:00:00 2001 From: John Coffey Date: Fri, 18 Sep 2026 18:49:10 -0700 Subject: [PATCH] Multi-tenancy decision before implementation: impersonate has no effect inside a tenant (MT-1, MT-15) --- docs/spec/features/multi-tenancy.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/spec/features/multi-tenancy.md b/docs/spec/features/multi-tenancy.md index 1a0e052..9c559bd 100644 --- a/docs/spec/features/multi-tenancy.md +++ b/docs/spec/features/multi-tenancy.md @@ -208,6 +208,11 @@ Each requirement has an ID, and tests name the IDs they check. - **MT-15.** The ceiling can never exceed what the server grants. No setting on a tenant can give its people a permission the server has disabled for them. + **Decision** (2026-09-18): `impersonate` never takes effect inside a + tenant, whatever the tenant allows. Impersonation reaches any account, so + in a tenant it would break MT-1. A tenant administrator manages its own + people's accounts and masks through its administrative permissions + instead. - **MT-16.** Changing a tenant's roles, permissions or quotas takes effect for its people without a restart and without them signing in again. The next request is judged by the new rules. **Decision**, a deliberate improvement: