PE8 ★ — the open default SWITCHES OFF once any grant row exists, plus the hierarchy collapse.
This is the deny half of the runtime helper's policy and the easiest place for a regression to
hide: "open by default" must mean "open ONLY while the grant list is empty". The moment a skill
has ANY row, a user who matches none of them must get NOTHING — not the open default.
Exercised through AISkillPermissionHelper.ComputeEffectivePermissions, the exported PURE core
over already-loaded arrays, with UNSAVED synthetic rows. Zero mutation, fully deterministic,
and independent of which identity the harness happens to run as.
PE8 ★ — the open default SWITCHES OFF once any grant row exists, plus the hierarchy collapse.
This is the deny half of the runtime helper's policy and the easiest place for a regression to hide: "open by default" must mean "open ONLY while the grant list is empty". The moment a skill has ANY row, a user who matches none of them must get NOTHING — not the open default.
Exercised through
AISkillPermissionHelper.ComputeEffectivePermissions, the exported PURE core over already-loaded arrays, with UNSAVED synthetic rows. Zero mutation, fully deterministic, and independent of which identity the harness happens to run as.