PE10 ★ — the AUTHORIZATION (capability) concern fails closed for a role-less identity.
AuthorizationEvaluator.UserCanExecuteWithAncestors walks the authorization tree matching the
user's ROLES. A user with zero roles must therefore be able to execute NOTHING — every named
capability gate (Can Share Skills, Schema Management, …) must refuse. If the evaluator ever
failed open on an empty role list, every feature gate in the product would open at once.
PE10 ★ — the AUTHORIZATION (capability) concern fails closed for a role-less identity.
AuthorizationEvaluator.UserCanExecuteWithAncestorswalks the authorization tree matching the user's ROLES. A user with zero roles must therefore be able to execute NOTHING — every named capability gate (Can Share Skills,Schema Management, …) must refuse. If the evaluator ever failed open on an empty role list, every feature gate in the product would open at once.