Per-app access permissions
Auto-generated from the source archive. Do not edit by hand — rerun
catalyst-changelog-syncinstead.
What changed
Section titled “What changed”- Registering a satellite app now also creates an IAM bounded context named after the app’s
codeand a dynamic<code>.accesspermission attached to the Administrator role — inside the same atomic registration transaction. Deleting the app removes both. - The dashboard read filters server-side: a user sees only the apps whose
<code>.accesspermission their roles grant; administrators see everything because they hold every permission, with no special-casing. - A namespace-collision guard fails the whole registration when the
codeclashes with an existing bounded-context or permission name, and an idempotent boot pass backfills the permission for apps registered before this change.
Why it matters
Section titled “Why it matters”Until now, anyone who could open the dashboard saw every registered app. You can now grant access app by app through the standard IAM roles UI — each satellite uses the platform’s usual <bc>.access permission shape, exactly like hub.access gates the HUB itself. Grants reach users at their next login or token refresh. Enforcing the permission in the OAuth authorize flow is a noted follow-up; this change gates dashboard visibility.