1012 B
1012 B
name, description
| name | description |
|---|---|
| shd-organizations-acl | Use when the user asks to inspect or change SHD organizations, members, invitations, roles, access audits or two-factor policies. |
SHD organizations and ACL
See references/organization-acl.md for identity resolution and mutation
boundaries.
Inspect
- Resolve the canonical organization ID; never use a guessed name as a write target.
- Read members, invitations, audit entries and the current two-factor policy before explaining access.
- Report organization, user, role, invitation state and policy as separate facts. A denied or incomplete list is not proof that a member is absent.
Change access
Inviting, adding, updating or removing a member, changing a two-factor policy, or creating, archiving or restoring an organization requires explicit intent. Show the exact organization and user scope before the mutation. Preserve server authorization, conflict checks and audit readback; never broaden access to make a failed request succeed.