Reports human steps assigned to someone other than the submitter, or null when there are none.
Cross-user assignment needs an authorization model (#3524) — deciding that A may put work in B's
inbox is a permissions question, not a graph question. Until it lands, a workflow can only ask the
person who started it.
Why refuse rather than reassign. Persist wrote task.UserID = submitter unconditionally, so
an authored assignToUserID was overwritten in silence. Every layer above accepts the field —
the flow compiler reads it into the spec, the validator passes it, the spec type declares it — so
silence here is indistinguishable from support: the graph submits, a step appears in the WRONG
person's inbox, the named person is never told, and the author has no reason to suspect any of it.
Refusing while the graph is still the author's to edit is the only point at which saying so costs
nothing.
Reports human steps assigned to someone other than the submitter, or
nullwhen there are none.Cross-user assignment needs an authorization model (#3524) — deciding that A may put work in B's inbox is a permissions question, not a graph question. Until it lands, a workflow can only ask the person who started it.
Why refuse rather than reassign. Persist wrote
task.UserID = submitterunconditionally, so an authoredassignToUserIDwas overwritten in silence. Every layer above accepts the field — the flow compiler reads it into the spec, the validator passes it, the spec type declares it — so silence here is indistinguishable from support: the graph submits, a step appears in the WRONG person's inbox, the named person is never told, and the author has no reason to suspect any of it. Refusing while the graph is still the author's to edit is the only point at which saying so costs nothing.