Multi-tenancy decision before implementation: impersonate has no effect inside a tenant (MT-1, MT-15)

2026-09-18 18:49:10 -07:00
parent 4a9aa9c548
commit ac2232c98d
1 changed files with 5 additions and 0 deletions
@@ -208,6 +208,11 @@ Each requirement has an ID, and tests name the IDs they check.
 - **MT-15.** The ceiling can never exceed what the server grants. No setting
  on a tenant can give its people a permission the server has disabled for
  them.
+  **Decision** (2026-09-18): `impersonate` never takes effect inside a
+  tenant, whatever the tenant allows. Impersonation reaches any account, so
+  in a tenant it would break MT-1. A tenant administrator manages its own
+  people's accounts and masks through its administrative permissions
+  instead.
 - **MT-16.** Changing a tenant's roles, permissions or quotas takes effect for
  its people without a restart and without them signing in again. The next
  request is judged by the new rules. **Decision**, a deliberate improvement: