{
  "version": "0.1.0",
  "updatedAt": "2026-06-19",
  "status": "draft-source-evidenced",
  "summary": "NDC Core Assistant access overlay. It controls assistant visibility and assistant-mediated capabilities, but never bypasses Launcher/HUB admin guards or OPS Gateway enforcement.",
  "roleVocabulary": [
    {
      "id": "assistant_blocked",
      "name": "Blocked",
      "summary": "No assistant icon, no assistant surface, no assistant capabilities."
    },
    {
      "id": "assistant_member",
      "name": "Member",
      "summary": "Default personal assistant access for active users inside their allowed contexts."
    },
    {
      "id": "assistant_admin",
      "name": "Admin",
      "summary": "Assistant-mediated administration, limited by existing Launcher root/client admin scope."
    }
  ],
  "roleAliases": [
    { "alias": "blocked", "roleId": "assistant_blocked" },
    { "alias": "off", "roleId": "assistant_blocked" },
    { "alias": "disabled", "roleId": "assistant_blocked" },
    { "alias": "member", "roleId": "assistant_member" },
    { "alias": "participant", "roleId": "assistant_member" },
    { "alias": "admin", "roleId": "assistant_admin" },
    { "alias": "administrator", "roleId": "assistant_admin" }
  ],
  "defaultResolution": {
    "activeUserDefaultRole": "assistant_member",
    "blockedUserEffectiveRole": "assistant_blocked",
    "disabledMembershipRemovesContextAdminScope": true,
    "superAdminDefaultRole": "assistant_admin",
    "assistantRoleDoesNotGrantLauncherAdmin": true
  },
  "sourceAuthorities": [
    {
      "id": "hub.launcher_global_role",
      "entityIds": ["hub.user", "hub.role"],
      "source": "/Users/dcconstructions/Downloads/mnt/data/nodedc_launcher/src/entities/user/types.ts",
      "summary": "LauncherGlobalRole includes root_admin, support_admin, client_owner, client_admin, member."
    },
    {
      "id": "hub.client_membership_role",
      "entityIds": ["hub.membership", "hub.role"],
      "source": "/Users/dcconstructions/Downloads/mnt/data/nodedc_launcher/src/entities/user/types.ts",
      "summary": "ClientMembershipRole includes client_owner, client_admin, member; membership status includes active/disabled."
    },
    {
      "id": "hub.resolve_admin_scope",
      "entityIds": ["assistant.admin_scope", "hub.membership", "hub.role"],
      "source": "/Users/dcconstructions/Downloads/mnt/data/nodedc_launcher/server/dev-server.mjs#resolveAdminScope",
      "summary": "Root scope comes from nodedc:superadmin/nodedc:launcher:admin groups. Client scope comes from active client_owner/client_admin membership."
    },
    {
      "id": "hub.admin_guards",
      "entityIds": ["assistant.admin_scope", "hub.user", "hub.client_context"],
      "source": "/Users/dcconstructions/Downloads/mnt/data/nodedc_launcher/server/dev-server.mjs#assertAdminCanManageClient/assertAdminCanManageUser/assertAdminCanManageAccessForUser",
      "summary": "Launcher backend guards constrain which client, user, memberships, grants, and requests an admin can manage."
    },
    {
      "id": "hub.admin_ui_access_matrix",
      "entityIds": ["hub.application_access", "ops.workspace_member", "ops.project_member"],
      "source": "/Users/dcconstructions/Downloads/mnt/data/nodedc_launcher/src/widgets/admin-overlay/AdminOverlay.tsx",
      "summary": "Admin UI already exposes MAIN status, MAIN role, service access, Operational Core workspace/project roles, invites, and access requests."
    }
  ],
  "capabilities": [
    { "id": "assistant.visible", "entityId": "assistant.capability", "level": "surface", "summary": "Assistant icon/surface can be shown." },
    { "id": "assistant.use", "entityId": "assistant.capability", "level": "member", "summary": "User can talk to personal assistant in allowed contexts." },
    { "id": "assistant.resolve_context", "entityId": "assistant.capability", "level": "member", "summary": "Assistant can use ontology to resolve HUB/OPS Product/ENGINE context." },
    { "id": "assistant.read_own_context", "entityId": "assistant.capability", "level": "member", "summary": "Assistant can read current user's allowed context summaries through permitted tools." },
    { "id": "assistant.create_own_ops_card", "entityId": "assistant.capability", "level": "member", "summary": "Assistant can help create/update OPS Product cards in a user-authorized project." },
    { "id": "assistant.request_own_engine_workflow_action", "entityId": "assistant.capability", "level": "member", "summary": "Assistant can prepare/request actions for Engine workflow context available to the user." },
    { "id": "assistant.view_admin_summary", "entityId": "assistant.capability", "level": "admin", "summary": "Assistant can summarize admin-visible users, memberships, invites, requests, and access matrix state." },
    { "id": "assistant.manage_users", "entityId": "assistant.capability", "level": "admin", "summary": "Assistant can request user profile/status updates through Launcher admin guards." },
    { "id": "assistant.manage_client_memberships", "entityId": "assistant.capability", "level": "admin", "summary": "Assistant can request client membership role/status changes through Launcher admin guards." },
    { "id": "assistant.view_pending_invites", "entityId": "assistant.capability", "level": "admin", "summary": "Assistant can list pending invites visible in admin scope." },
    { "id": "assistant.manage_invites", "entityId": "assistant.capability", "level": "admin", "summary": "Assistant can create/update/revoke invites inside admin scope." },
    { "id": "assistant.view_access_requests", "entityId": "assistant.capability", "level": "admin", "summary": "Assistant can list pending access/workflow/tasker requests visible in admin scope." },
    { "id": "assistant.manage_ops_workspace_membership", "entityId": "assistant.capability", "level": "admin", "summary": "Assistant can request Operational Core workspace membership changes through Launcher admin guards." },
    { "id": "assistant.manage_ops_project_membership", "entityId": "assistant.capability", "level": "admin", "summary": "Assistant can request Operational Core project membership changes through Launcher admin guards." },
    { "id": "assistant.manage_engine_workflow_requests", "entityId": "assistant.capability", "level": "root", "summary": "Assistant can approve/reject Engine workflow access requests only when Launcher route remains root-only." },
    { "id": "assistant.manage_service_catalog", "entityId": "assistant.capability", "level": "root", "summary": "Assistant can request service catalog/settings mutations only for root scope." },
    { "id": "assistant.manage_assistant_access", "entityId": "assistant.capability", "level": "admin", "summary": "Assistant can request changes to assistant role assignments inside admin scope after this feature is implemented in HUB." }
  ],
  "roleMatrix": [
    {
      "roleId": "assistant_blocked",
      "visible": false,
      "canUse": false,
      "allowedCapabilities": [],
      "deniedCapabilities": ["*"],
      "summary": "Hard off."
    },
    {
      "roleId": "assistant_member",
      "visible": true,
      "canUse": true,
      "allowedCapabilities": [
        "assistant.visible",
        "assistant.use",
        "assistant.resolve_context",
        "assistant.read_own_context",
        "assistant.create_own_ops_card",
        "assistant.request_own_engine_workflow_action"
      ],
      "deniedCapabilities": [
        "assistant.view_admin_summary",
        "assistant.manage_users",
        "assistant.manage_client_memberships",
        "assistant.view_pending_invites",
        "assistant.manage_invites",
        "assistant.view_access_requests",
        "assistant.manage_ops_workspace_membership",
        "assistant.manage_ops_project_membership",
        "assistant.manage_engine_workflow_requests",
        "assistant.manage_service_catalog",
        "assistant.manage_assistant_access"
      ],
      "summary": "Current default personal assistant behavior."
    },
    {
      "roleId": "assistant_admin",
      "visible": true,
      "canUse": true,
      "allowedCapabilities": [
        "assistant.visible",
        "assistant.use",
        "assistant.resolve_context",
        "assistant.read_own_context",
        "assistant.create_own_ops_card",
        "assistant.request_own_engine_workflow_action",
        "assistant.view_admin_summary",
        "assistant.manage_users",
        "assistant.manage_client_memberships",
        "assistant.view_pending_invites",
        "assistant.manage_invites",
        "assistant.view_access_requests",
        "assistant.manage_ops_workspace_membership",
        "assistant.manage_ops_project_membership",
        "assistant.manage_assistant_access"
      ],
      "conditionalCapabilities": [
        {
          "capabilityId": "assistant.manage_engine_workflow_requests",
          "requires": "launcher_admin_scope.root"
        },
        {
          "capabilityId": "assistant.manage_service_catalog",
          "requires": "launcher_admin_scope.root"
        }
      ],
      "deniedWhenNoAdminScope": [
        "assistant.view_admin_summary",
        "assistant.manage_users",
        "assistant.manage_client_memberships",
        "assistant.view_pending_invites",
        "assistant.manage_invites",
        "assistant.view_access_requests",
        "assistant.manage_ops_workspace_membership",
        "assistant.manage_ops_project_membership",
        "assistant.manage_engine_workflow_requests",
        "assistant.manage_service_catalog",
        "assistant.manage_assistant_access"
      ],
      "summary": "Assistant-admin commands are enabled only when existing Launcher admin scope is present."
    }
  ],
  "operations": [
    {
      "id": "assistant.op.change_user_status",
      "capabilityId": "assistant.manage_users",
      "sourceEndpoints": ["PATCH /api/admin/users/:userId/profile"],
      "requiredGuards": ["requireLauncherAdmin", "assertAdminCanManageUser"],
      "summary": "Block/unblock/invite-state management for a user visible in admin scope."
    },
    {
      "id": "assistant.op.change_client_membership",
      "capabilityId": "assistant.manage_client_memberships",
      "sourceEndpoints": ["PATCH /api/admin/memberships/:membershipId"],
      "requiredGuards": ["requireLauncherAdmin", "assertAdminCanManageMembership"],
      "summary": "Change client role/status for a visible membership."
    },
    {
      "id": "assistant.op.list_pending_invites",
      "capabilityId": "assistant.view_pending_invites",
      "sourceEndpoints": ["GET /api/admin/control-plane"],
      "requiredGuards": ["requireLauncherAdmin", "scopeControlPlaneData"],
      "summary": "List pending invites visible after Launcher data scoping."
    },
    {
      "id": "assistant.op.manage_ops_workspace_membership",
      "capabilityId": "assistant.manage_ops_workspace_membership",
      "sourceEndpoints": ["POST /api/admin/task-manager/workspace-memberships/ensure"],
      "requiredGuards": ["requireLauncherAdmin", "assertAdminCanManageClient", "assertAdminCanManageAccessForUser"],
      "hardDenies": ["assistant.deny.task_manager_admin_role_locked"],
      "summary": "Ensure/revoke Operational Core workspace access without granting Task Manager admin role."
    },
    {
      "id": "assistant.op.manage_ops_project_membership",
      "capabilityId": "assistant.manage_ops_project_membership",
      "sourceEndpoints": ["POST /api/admin/task-manager/project-memberships/ensure"],
      "requiredGuards": ["requireLauncherAdmin", "assertAdminCanManageClient", "assertAdminCanManageAccessForUser"],
      "hardDenies": ["assistant.deny.task_manager_admin_role_locked"],
      "summary": "Ensure/revoke Operational Core project access without granting Task Manager admin role."
    },
    {
      "id": "assistant.op.manage_engine_workflow_request",
      "capabilityId": "assistant.manage_engine_workflow_requests",
      "sourceEndpoints": ["PATCH /api/admin/engine-workflow-access-requests/:requestId/approve", "PATCH /api/admin/engine-workflow-access-requests/:requestId/reject"],
      "requiredGuards": ["requireRootLauncherAdmin"],
      "summary": "Root-only request management stays root-only."
    }
  ],
  "hardDenies": [
    {
      "id": "assistant.deny.task_manager_admin_role_locked",
      "entityIds": ["ops.workspace_member", "ops.project_member"],
      "summary": "Launcher source currently forbids requestedRole === admin for Task Manager workspace/project membership mutations."
    },
    {
      "id": "assistant.deny.protected_user_root_locked",
      "entityIds": ["hub.user"],
      "summary": "Protected user_root cannot be managed by ordinary admins; source guards protect it."
    },
    {
      "id": "assistant.deny.no_scope_escalation",
      "entityIds": ["assistant.access_role", "assistant.admin_scope", "agent.grant"],
      "summary": "Assistant role cannot create Launcher admin scope or Gateway grants by itself."
    },
    {
      "id": "assistant.deny.root_only_stays_root_only",
      "entityIds": ["hub.client_context", "hub.application", "engine.workflow_access_request"],
      "summary": "Root-only backend endpoints remain root-only even when assistant role is assistant_admin."
    }
  ]
}
