0017 — Grading, audit, authorship and reviewer access controls

• Date: 2026-09-18
• Status: decided
• Governs: STD-S (security), STD-D (data), Codex 11 (institutional systems), Codex 5 (data model)
• Owner: Technology (DIV-05)
• Review date: 2027-09-18

Decision

Least-privilege pass completed after the launch security review (DECISION-0016). Four further defects were found by scan and corrected:

1. 1Self-grading. lrn_assessment_attempts allowed a learner to set score, passed, grader_id, feedback and resolved_at on their own attempt. A SECURITY DEFINER trigger now rejects any write to those columns unless the actor holds instructor or admin. Learners may still start and submit attempts. A credential that a learner can award themselves is not a credential (Codex 5; STD-S).

1. 1Audit-log forgery. aud_audit_events and aud_access_events accepted direct inserts from any signed-in user provided actor_id matched. Client insert rights are withdrawn; the two legitimate writers (src/lib/leads/admin.server.ts, src/lib/academy-faculty.server.ts) now write through the server's privileged client after their own role checks. The record of what happened cannot be authored by the party it describes.

1. 1Reviewer over-reach. The submissions reviewer policy compared peer_reviews.submission_id to peer_reviews.id, an uncorrelated condition that let anyone assigned as a reviewer of any submission read every submission in the table. Now correlated to the queried row.

1. 1Authorship exposure. kno_authors exposed person_id and affiliation for any active row. Now visible publicly only when the author is attached to a published, public knowledge item and the person has explicitly chosen a public profile. Absence of a stated preference is read as private (Codex 11: consent is affirmative, never assumed).

Retained by intent

The permission-resolution functions (has_role, has_permission, can_*, is_academy_faculty_for_course) remain executable by signed-in users. Row-level policies invoke them on every read; withdrawing execution would lock members out of their own records. The scanner flags the pattern, not a fault.

Consequences

No public surface, no navigation, no content and no terminology changed. Grading now requires faculty standing, which is the intended institutional workflow.