ADR: record the spaces-membership decision (app-owned default, IdP-write optional) #212

New issue

Closed

opened 2026-08-13 15:17:00 +00:00 by Cordy · 0 comments

Cordy commented

2026-08-13 15:17:00 +00:00

Owner

Parent: #211.

Record the architecture decision in-repo so the reasoning survives: the two-model design (read-only IdP-group spaces vs app-owned Cairn spaces), why IdP-write is demoted to an optional power mode (blast radius of manage-users, AD non-starter, separation of duties, sovereignty alignment), the industry grounding (Nextcloud local+LDAP hybrid; Google/SharePoint reference-not-mutate; Keycloak read vs write privilege line), and the security/trust comparison.

Deliverable: a decision record next to IMPLEMENTED-PEERING.md (e.g. docs/adr/0001-spaces-membership.md or IMPLEMENTED-SPACES.md), linked from ARCHITECTURE.md. Product-neutral. This is the written form of the decision memo from the dogfood session.

First sub-issue to land (documents intent before the code).

Parent: #211. Record the architecture decision in-repo so the reasoning survives: the two-model design (read-only IdP-group spaces vs app-owned Cairn spaces), why IdP-write is demoted to an optional power mode (blast radius of `manage-users`, AD non-starter, separation of duties, sovereignty alignment), the industry grounding (Nextcloud local+LDAP hybrid; Google/SharePoint reference-not-mutate; Keycloak read vs write privilege line), and the security/trust comparison. **Deliverable:** a decision record next to `IMPLEMENTED-PEERING.md` (e.g. `docs/adr/0001-spaces-membership.md` or `IMPLEMENTED-SPACES.md`), linked from `ARCHITECTURE.md`. Product-neutral. This is the written form of the decision memo from the dogfood session. First sub-issue to land (documents intent before the code).