Parent Feature
#1558
User Story
As a project access-administration holder or group manager, I want revocation (removing a member
from a group, or removing a group grant from a project) to take effect quickly and predictably,
so that a removed user or team loses access without waiting for a session or cache to expire.
Acceptance Criteria
- Given a group grant is revoked from a project or a member is removed from a shared group, When
the next authorization decision for that user/project runs, Then access is denied — with a
maximum observed propagation delay of 60s across all deployed instances (asserted by integration
tests).
- Given a member is removed from a group, When the removal completes, Then they immediately lose
group-derived access to all projects the group is shared on and receive the revocation email.
- Given a group is dissolved, When the dissolution completes, Then all its ACEs are removed from
acl_entry (no orphaned GROUP_<id> SID remains) and all its group_membership rows are
deleted.
- Given a member removed from a group still has a direct grant on a project, When the next
authorization check runs, Then their access reverts to the maximal of their remaining direct and
system-role grants — not the removed group grant.
Requirement IDs: GROUP-R-07, GROUP-NFR-01, GROUP-NFR-03
Tracking
Parent Feature
#1558
User Story
Acceptance Criteria
the next authorization decision for that user/project runs, Then access is denied — with a
maximum observed propagation delay of 60s across all deployed instances (asserted by integration
tests).
group-derived access to all projects the group is shared on and receive the revocation email.
acl_entry(no orphanedGROUP_<id>SID remains) and all itsgroup_membershiprows aredeleted.
authorization check runs, Then their access reverts to the maximal of their remaining direct and
system-role grants — not the removed group grant.
Requirement IDs:
GROUP-R-07,GROUP-NFR-01,GROUP-NFR-03Tracking
FEAT-USER-GROUPS-13