DEC-003 — Bounded Core V1 Capability Taxonomy

Status: FORMALIZED_FOR_T1_CORE
Approval basis: requesting-user instruction to execute the bounded Core V1 recommendation on 2026-08-10. This record does not certify optional business workflows.

Decision

Scola authorization uses a canonical capability vocabulary with separate action and scope semantics. Assigned roles are eligibility; the session active role is the authority context. Entitlement and installation are required package gates, not substitutes for capability or record scope.

Canonical action vocabulary

The Core contract recognizes only these action classes unless a later decision extends the vocabulary:

view, list, create, update, delete, archive, manage, approve, reject, publish, export, configure, execute, reset, activate, and deactivate.

view/list never imply mutation, approval, export, credential change, or cross-tenant access. manage is not a wildcard for unrelated domains; it must be bound to a named resource and scope.

Canonical scope vocabulary

Every protected action must resolve against one or more of:

tenant, company, school_unit, class_or_batch, assignment, self, linked_child, linked_parent, record_owner, and cross_company.

cross_company is denied by default. A route that does not declare its scope is not a certified Core route. Foreign IDs and mixed-company foreign keys must be rejected atomically without existence leaks.

Core role/action/scope contract

Role context	Allowed Core examples	Scope rule
school_admin / head_admin	Core student, parent, academic, timetable, manual-attendance and communication management	Own company/school; no implicit cross-company access
admin_staff	Approved operational Core reads and explicitly granted mutations	Own company and assigned operational scope
teacher	Schedule/read, assigned student roster and attendance actions explicitly granted	Assignment/class/batch scope; no arbitrary student or company scope
homeroom	Teacher capabilities plus homeroom-specific class/child views	Assigned homeroom/class and linked child scope
student	Own profile, own attendance/academic/communication reads	self only, except explicitly projected public/core data
parent	Linked-child portal and attendance/academic reads	linked_child only; no peer-child lookup
principal / approved leadership read role	Approved Core aggregate/read surfaces	Own company/school; no mutation unless separately declared
platform_operator	Platform control-plane operations	Platform tenant scope; not school-user data by default

This table is the bounded Core baseline. Optional roles and domains such as HR, payroll, finance, admissions, Dapodik, BOS, and smart attendance require their own package decision and must remain denied/gated until then.

Enforcement contract

1. FE menu and router metadata may improve UX only; backend registry, capability resolver, ACL/record rules, and tenant scope are authoritative.
2. API registry entries must declare domain, capability, method/action precedence, and optional feature flag. Unknown protected routes fail closed.
3. Direct dataset/RPC calls cannot bypass the same action, capability, package, and record-scope contract.
4. Capability resolution uses the session active role; inactive assigned roles, global role fields, and group unions cannot widen authority.
5. Installation without entitlement, or entitlement without capability, does not expose a menu, route, API, model, attachment, or mutation.
6. Elevated service paths must name the allowed model/action and re-check company and record ownership before any sudo/superuser operation.

Machine-readable acceptance

The authoritative matrix and acceptance cases are in T0-E2-DEC-003-capability-taxonomy.json. T1 may begin only after the current-tip E1.2 evidence rebind passes and these Core acceptance cases remain green:

• inactive-role conflict cannot widen a capability;
• role switch changes only that session;
• protected route and method/action variants resolve explicitly;
• unknown protected route is denied;
• Core read/list/detail/mutation/attachment/mail paths reject foreign-company records;
• optional installed-but-unentitled API and direct model RPC are denied;
• parent/self/assignment scopes reject unrelated IDs;
• FE capability metadata and BE registry agree for every T1 route.

Optional-domain capability matrices remain downstream and are not silently included in this decision.