0016 — Least-privilege access controls before launch

• Date: 2026-09-18
• Decision rights: Executive Office, on the advice of the Technology division (DIV-05)
• Governs: STD-S §Access control; Codex 0 §08 (permissions)
• System: SYS-12 Infrastructure, with SYS-01 Identity

Decision

Three access-control defects were closed before the institution invites the public to the site.

1. 1Application documents. Anonymous write access to the applications store is withdrawn entirely. A document is uploaded only against a short-lived, single-use permit issued by the institution's own server, which chooses the storage path and validates the intake pathway, file extension, media type and declared size. The store accepts at most 10MB per file. Reading application documents remains restricted to administrators.
2. 2Review-cycle records. Governance review cycles are no longer readable by anonymous visitors. Reading requires the administrator role or the governance.read permission at institution scope. No public surface consumed this table.
3. 3Internal database functions. Execute rights on the institution's internal record-keeping functions are withdrawn from public, anonymous and ordinary signed-in access. They are invoked by the database itself.

Why

An intake pathway is an invitation, not an open write endpoint. Governance deliberation is internal until it is ratified (Codex 9). Least privilege is the default posture required by STD-S; each of these three was a grant nobody used.

Retained deliberately

The permission-resolution functions (has_role, has_permission, can_read_*, can_manage_*, is_academy_faculty_for_course) remain executable by signed-in users. The access rules themselves call them, and each is scoped to the calling identity, so withdrawing that right would lock legitimate members out of their own records. The scanner flags this class by pattern; it is intentional.

Result — review date 2027-03-18

To be written at the review date whether or not it flatters the decision.