From 488aceea7536e93de34a7121cb571b2bda62b784 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 11 Oct 2026 06:34:58 +0000 Subject: [PATCH 1/2] =?UTF-8?q?docs:=20V17=20=E2=80=94=20V19=20expansion?= =?UTF-8?q?=20shipped;=20flag=20trustee-kind=20conflict=20(X14)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 'until V19's expansion lands' line was stale since lance-graph #1458/#1463. The per-right trustee kinds are flagged as under review against the Microsoft cmdlet reference, without changing the ruling. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg --- docs/DIRECTORY-SIMULATION-POC.md | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/docs/DIRECTORY-SIMULATION-POC.md b/docs/DIRECTORY-SIMULATION-POC.md index d7bf463..426e5e0 100644 --- a/docs/DIRECTORY-SIMULATION-POC.md +++ b/docs/DIRECTORY-SIMULATION-POC.md @@ -491,8 +491,18 @@ no-population-intermediate rule. nested mail-enabled groups only (V19). A grant to a group that is not mail-enabled is a violation. - Until V19's expansion lands, a grant to a group reaches only the - group's direct members. + V19's expansion has shipped (lance-graph #1458, #1463): + `View::security_identifiers` gives the SID chain and + `groups_transitive_through` the mail chain, so a grant to a group + reaches its nested members. + + **Under review (2026-10-11, not yet ruled):** the per-right trustee + kinds above conflict with the Microsoft cmdlet reference on three + points. These are FullAccess with non-mail security groups + on-premises, SendAs in Exchange Online, and `GrantSendOnBehalfTo` + needing a mail-enabled principal. The conflict concerns which trustee + may be named, not how membership passes a right down. See lance-graph + `.claude/board/entries/2026-10-11-coresearch-instance-authz.md` (X14). - **Denies follow ACE precedence.** Exchange allows deny entries on FullAccess, and Active Directory allows them on SendAs. Each entry keeps whether it is inherited (`IsInherited` in From ba46ec9345a805ae886057ff9f5f167326cc2ba6 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 11 Oct 2026 06:39:48 +0000 Subject: [PATCH 2/2] =?UTF-8?q?docs:=20V17=20=E2=80=94=20nested=20members?= =?UTF-8?q?=20reached=20only=20through=20the=20applicable=20chain?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg --- docs/DIRECTORY-SIMULATION-POC.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/DIRECTORY-SIMULATION-POC.md b/docs/DIRECTORY-SIMULATION-POC.md index 426e5e0..c16bdd4 100644 --- a/docs/DIRECTORY-SIMULATION-POC.md +++ b/docs/DIRECTORY-SIMULATION-POC.md @@ -492,9 +492,10 @@ no-population-intermediate rule. mail-enabled is a violation. V19's expansion has shipped (lance-graph #1458, #1463): - `View::security_identifiers` gives the SID chain and - `groups_transitive_through` the mail chain, so a grant to a group - reaches its nested members. + `View::security_identifiers` gives the security-enabled SID chain and + `groups_transitive_through` the mail-enabled chain, so a grant to a + group reaches nested members only through the chain that applies to + the right. **Under review (2026-10-11, not yet ruled):** the per-right trustee kinds above conflict with the Microsoft cmdlet reference on three