Record identity scoped to its object

Context

Runtime categories need separately scoped staff access while the permission catalogue remains deployment-managed.

Decision

One deployment-defined record permission set uses object scope, and roles-only categories additionally require active assignments specifically scoped to that object.

Alternatives Considered

Creating permission keys at object creation: Permission keys are deployment-managed, whereas object definitions are runtime configuration. Applying built-in reach to every object: Sensitive categories need an object-specific mode that does not rely on broad built-in grants.

Consequences

The published record-key tiers define administrator, user and read-only reach. Object invisibility is expressed as not found on scoped record access. System contexts without a permission slice have workspace-wide object reach.