[simplesagar]

Requested by Sagar · project thread

Summary

• Adds memory:read and memory:write to authz/scopes.go. Both are project-scoped (the memory family maps to ResourceKindProject, like log:read), user-visible, and owned by the access grant surface. memory:write satisfies memory:read.
• Neither scope is in any system role, not even admin, and neither is agent-runtime-safe. Neither project:*, org:admin nor chat:* implies them. Tests pin all of this.
• Registers both in ListScopes, the full-access grant list, the runtime-policy registry, the access design enums (regenerated Goa output), the dashboard SDK enums and the role matrix copy.
• Documents both in docs/rbac.md.

No handler uses the scopes yet. The team memory tools (search_team_memory, remember, and the recall/zoom tools) will enforce them in follow-up PRs, behind the team-memory flag.

Motivation

Team memory exposes masked summaries of every member's sessions in a project, so reading it needs an explicit grant, following the chat:read / log:read precedent. Landing the scopes on their own keeps the tool PRs small.

The dashboard SDK enum files and .speakeasy/out.openapi.yaml were updated by hand to match the regenerated Goa output, because the SDK generator couldn't run in this environment. CI's SDK drift check will confirm they match.

---

Generated by Claude Code

---

Summary by cubic

Adds memory:read and memory:write authorization scopes so a project's team memory requires an explicit grant. No handler enforces them yet; the team memory tools will do so in follow-up PRs behind the team-memory flag.

• Both scopes are project-scoped and user-visible; memory:write implies memory:read.
• Neither is in any system role, including admin, and neither project:*, org:admin, nor chat:* implies them, since team memory summarizes every member's sessions.
• The role matrix now shows the team memory entry as included when memory:write is granted.
• Registers the scopes in the scope list, access grant list, runtime-policy registry, access design enums, dashboard SDK enums, and RBAC docs.
• Dashboard SDK enum files and .speakeasy/out.openapi.yaml were updated by hand to match regenerated Goa output; CI's SDK drift check will confirm they match.

^{Written for commit f9d6ebd. Summary will update on new commits.}

[changeset-bot]

🦋 Changeset detected

Latest commit: f9d6ebd

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
server	Patch
dashboard	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cubic-dev-ai]

1 issue found across 24 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="server/design/access/design.go">

<violation number="1" location="server/design/access/design.go:1231">
P2: Custom agent: **Keep Platform MCP In Sync**

Platform MCP has no workflow to grant or revoke these new team-memory permissions: its role mutation tools accept MCP access rules or inference grants, not `memory:read`/`memory:write`. Add a confirmed, project-scoped memory-grant workflow so administrators can manage this access through Platform MCP.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: Custom agent: Keep Platform MCP In Sync

Platform MCP has no workflow to grant or revoke these new team-memory permissions: its role mutation tools accept MCP access rules or inference grants, not memory:read/memory:write. Add a confirmed, project-scoped memory-grant workflow so administrators can manage this access through Platform MCP.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At server/design/access/design.go, line 1231:

<comment>Platform MCP has no workflow to grant or revoke these new team-memory permissions: its role mutation tools accept MCP access rules or inference grants, not `memory:read`/`memory:write`. Add a confirmed, project-scoped memory-grant workflow so administrators can manage this access through Platform MCP.</comment>

<file context>
@@ -1228,7 +1228,7 @@ var RoleGrantModel = Type("RoleGrant", func() {
 	Attribute("scope", String, func() {
 		Description("The scope slug this grant applies to.")
-		Enum("org:read", "org:blocked_read", "org:admin", "org:blocked_admin", "project:read", "project:blocked_read", "project:write", "project:blocked_write", "mcp:read", "mcp:blocked_read", "mcp:write", "mcp:blocked_write", "mcp:connect", "mcp:blocked_connect", "mcp:auth", "mcp:blocked_auth", "environment:read", "environment:blocked_read", "environment:write", "environment:blocked_write", "skill:read", "skill:blocked_read", "skill:write", "skill:blocked_write", "assistant:read", "assistant:blocked_read", "assistant:write", "assistant:blocked_write", "plugin:write", "plugin:blocked_write", "risk_policy:evaluate", "risk_policy:bypass", "risk_policy:block", "chat:read", "chat:write", "inference:execute", "log:read", "agent:read", "agent:write", "agent:authorize", "agent:transfer", "workload:read", "workload:blocked_read", "workload:write", "workload:blocked_write", "org:device_agent_sync", "org:hooks_ingest")
+		Enum("org:read", "org:blocked_read", "org:admin", "org:blocked_admin", "project:read", "project:blocked_read", "project:write", "project:blocked_write", "mcp:read", "mcp:blocked_read", "mcp:write", "mcp:blocked_write", "mcp:connect", "mcp:blocked_connect", "mcp:auth", "mcp:blocked_auth", "environment:read", "environment:blocked_read", "environment:write", "environment:blocked_write", "skill:read", "skill:blocked_read", "skill:write", "skill:blocked_write", "assistant:read", "assistant:blocked_read", "assistant:write", "assistant:blocked_write", "plugin:write", "plugin:blocked_write", "risk_policy:evaluate", "risk_policy:bypass", "risk_policy:block", "chat:read", "chat:write", "inference:execute", "log:read", "memory:read", "memory:write", "agent:read", "agent:write", "agent:authorize", "agent:transfer", "workload:read", "workload:blocked_read", "workload:write", "workload:blocked_write", "org:device_agent_sync", "org:hooks_ingest")
 	})
 
</file context>

[simplesagar]

Not changing this in this PR. The Platform MCP role mutation tools are deliberately limited to MCP-only access roles plus the inference grant. Granting a sensitive project-wide read like memory:read (or chat:read, log:read, which have no MCP grant workflow either) through an agent is a product decision that belongs with the rollout PR, not with registering the scopes. These scopes are managed through the Access page like the other explicit-grant scopes. The team memory tools that enforce them are external-only and appear only to callers who already hold a grant.

---

Generated by Claude Code

[blacksmith-sh]

Found 1 test failure on Blacksmith runners:

Failure

Test	View Logs
github.com/speakeasy-api/gram/server/internal/litellm/ TestTracePersistenceKeepsOnlyAllowlistedAttributes	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[simplesagar]

server-test shard 4 fails in TestTracePersistenceKeepsOnlyAllowlistedAttributes (internal/litellm/traces_test.go:996, "should have 4 item(s), but has 0"). This PR didn't cause it. The same test fails locally on the base commit 7ff6694e, and current main has no fix yet.

Cause: the OTLP contract fixtures are timestamped 2026-08-01, and ClickHouse drops telemetry_logs rows older than 90 days (TTL ... + INTERVAL 90 DAY in server/clickhouse/schema.sql). As of 2026-10-30 the fixture rows expire on insert, so the query returns nothing. It needs a fixture or test change in the litellm package, which is out of scope for this PR.

---

Generated by Claude Code