Docs: spaces & membership handbook — two models, config, optional IdP-write power mode #218

New issue

Closed

opened 2026-08-13 15:17:48 +00:00 by Cordy · 0 comments

Cordy commented

2026-08-13 15:17:48 +00:00

Owner

Parent: #211. Land as the feature ships (don't document ahead of behaviour).

Update the handbook for the shipped model:

spaces.md (or the spaces section): the two kinds of space — read-only IdP-group spaces vs app-owned Cairn spaces — what each is for, how membership works, owner/roles, and the collision rule.
deployment.md / config reference: the new group/IdP config block (read client vs write power mode), that app-owned spaces are the default and need no IdP client, and the manage-users blast-radius warning on the power mode.
encryption.md: fix the now-stale coupling — the Keycloak admin client is no longer an encryption/custody concern.
Cross-link the ADR (#212).

Product-neutral, per the handbook rules. Also feeds the v0.8 doc-refresh (#206).

Parent: #211. Land as the feature ships (don't document ahead of behaviour). Update the handbook for the shipped model: - `spaces.md` (or the spaces section): the two kinds of space — **read-only IdP-group spaces** vs **app-owned Cairn spaces** — what each is for, how membership works, owner/roles, and the collision rule. - `deployment.md` / config reference: the new group/IdP config block (read client vs write power mode), that app-owned spaces are the default and need no IdP client, and the `manage-users` blast-radius warning on the power mode. - `encryption.md`: fix the now-stale coupling — the Keycloak admin client is no longer an encryption/custody concern. - Cross-link the ADR (#212). Product-neutral, per the handbook rules. Also feeds the v0.8 doc-refresh (#206).