PE6 ★ — the TWO-ACCESS-PATH contract for AI Agents, the headline asymmetry of this domain.
Both paths read the SAME MJ: AI Agent Permissions table, and they DELIBERATELY disagree:
AIAgentPermissionHelper (cached, @memberjunction/ai-engine-base) is the hot runtime gate
and is OPEN by default: with no grant rows, ANY user may View and Run; only the owner
may Edit or Delete.
AIAgentPermissionProvider (per-query, @memberjunction/core-entities) is the audit /
Sharing-Center view and is CLOSED by default: it reports only EXPLICIT grants, so the
same agent yields [] and a denied Execute.
This is by design (guides/UNIFIED_PERMISSIONS_GUIDE.md §3) and is pinned here so nobody
"fixes" one path into agreement with the other. The difference — not either result alone —
is the assertion, so a high-privilege context user cannot make this check vacuous.
PE6 ★ — the TWO-ACCESS-PATH contract for AI Agents, the headline asymmetry of this domain.
Both paths read the SAME
MJ: AI Agent Permissionstable, and they DELIBERATELY disagree:AIAgentPermissionHelper(cached,@memberjunction/ai-engine-base) is the hot runtime gate and is OPEN by default: with no grant rows, ANY user may View and Run; only the owner may Edit or Delete.AIAgentPermissionProvider(per-query,@memberjunction/core-entities) is the audit / Sharing-Center view and is CLOSED by default: it reports only EXPLICIT grants, so the same agent yields[]and a denied Execute.This is by design (guides/UNIFIED_PERMISSIONS_GUIDE.md §3) and is pinned here so nobody "fixes" one path into agreement with the other. The difference — not either result alone — is the assertion, so a high-privilege context user cannot make this check vacuous.