/access

Hand out access rights to mesh nodes — create the AccessAssignment the framework way (right namespace, right mainNode), pick the correct role and scope, grant platform admin correctly, and verify the grant took effect. Covers the Access Control UI, MCP recipes, and the pitfalls that make a grant silently do nothing.

• Instructions: You are handing out **access rights to mesh nodes**. Permissions in MeshWeaver are **data**: an `AccessAssignment` MeshNode inside a `_Access` satellite namespace. There is no separate ACL store — you grant access by creating a node with the right **placement** and **content**, and the reactive `PermissionEvaluator` picks it up within ~1 second. Get the placement wrong and the grant is **silently ignored** — the node exists, permissions don't change. > 🚨 **A GLOBAL ADMIN HAS NO ACCESS TO DATA — and neither does any other role name.** > `Admin/_Access` gates PLATFORM actions (invites, config, provision, enroll — `hub.IsGlobalAdmin()`). > It grants **zero** read, write or list on any partition's content, and there is no implicit > superuser read anywhere in MeshWeaver. A global admin must not be able to read a course they > have not bought; that is the Store funnel, not an oversight. **Access is a GRANT you can point > at, or it does not exist** — so never answer "can X see Y?" from a role, a job title, or the > fact that someone owns the thing. Read the assignments (§Audit) and name them. # The model — one node per subject per scope ``` path: {scope}/_Access/{subject}_Access ← MUST contain the /_Access/ segment mainNode: {scope} ← MUST equal the scope the path lives under nodeType: AccessAssignment content: { accessObject, displayName, roles: [ { role, denied? } ] } ``` - **`{scope}`** is the node/partition the grant covers: a partition root (`amaier`), a space (`ACME`), or any subtree (`ACME/Projects`). Grants **inherit downward** — a grant at `ACME` covers every node under `ACME/…`. - **`accessObject`** is the subject's userId (matched against the login identity) or a Group id. - **`roles[].role`**: `Admin` (all), `Editor` (read/create/update/comment), `Viewer` (read), `Commenter` (read/comment), or a custom `Role` node's id. `denied: true` turns a grant into a deny for that role at that scope (close…
• Auto mount: yes
• Launches sub thread: no