Summary
The teamlead permission role is redundant and misleading: it is a read-only multi-group role even though groupadmin assignments already support the intended team-lead model across multiple groups. Keeping both roles makes the documented hierarchy disagree with operational expectations and leaves group administrators unable to manage their own memberships.
Findings
1. TeamLead is intentionally excluded from writes
helixir/src/core/rbac/types.rs:48 excludes Role::TeamLead from can_write, despite the product model expecting a lead to write into each managed group.
2. GroupAdmin already composes across groups
helixir/src/core/rbac/policy.rs stores roles in UserBinding.groups, so one principal can hold groupadmin in any number of groups without another permission role.
3. Group administration is unnecessarily global-only
helixir/src/core/rbac/manager_admin.rs:291, helixir/src/core/rbac/manager_authorization.rs:105, and helixir/src/core/rbac_registry.rs:204 require global admin for membership grants and revocations, so groupadmin currently controls data but not the group.
Proposed fix
- Stop accepting new
teamlead grants while retaining safe parsing of legacy assignments.
- Add an explicit, administrator-controlled migration from legacy
teamlead assignments to groupadmin.
- Allow
groupadmin to list and manage membership/roles only inside assigned non-reserved groups.
- Keep group creation/deletion, reserved workspaces, global roles, and dedup federations global-admin-only.
- Update README, MCP prompts, repository skill, engineering docs, and tests.
Acceptance criteria
Summary
The
teamleadpermission role is redundant and misleading: it is a read-only multi-group role even thoughgroupadminassignments already support the intended team-lead model across multiple groups. Keeping both roles makes the documented hierarchy disagree with operational expectations and leaves group administrators unable to manage their own memberships.Findings
1. TeamLead is intentionally excluded from writes
helixir/src/core/rbac/types.rs:48excludesRole::TeamLeadfromcan_write, despite the product model expecting a lead to write into each managed group.2. GroupAdmin already composes across groups
helixir/src/core/rbac/policy.rsstores roles inUserBinding.groups, so one principal can holdgroupadminin any number of groups without another permission role.3. Group administration is unnecessarily global-only
helixir/src/core/rbac/manager_admin.rs:291,helixir/src/core/rbac/manager_authorization.rs:105, andhelixir/src/core/rbac_registry.rs:204require global admin for membership grants and revocations, sogroupadmincurrently controls data but not the group.Proposed fix
teamleadgrants while retaining safe parsing of legacy assignments.teamleadassignments togroupadmin.groupadminto list and manage membership/roles only inside assigned non-reserved groups.Acceptance criteria
teamleadgrants fail with migration guidance.teamleadassignments remain readable until explicitly migrated.groupadmincan add/remove members and roles only in an assigned non-reserved group.groupadmincannot mutate other groups, reserved workspaces, global roles, or dedup federations.