Skip to content

docs: V17 — V19 expansion shipped; flag trustee-kind conflict (X14) #351

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AdaWorldAPI merged 2 commits into from
Oct 11, 2026
Merged

docs: V17 — V19 expansion shipped; flag trustee-kind conflict (X14) #351

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
488acee
docs: V17 — V19 expansion shipped; flag trustee-kind conflict (X14)
claude Oct 11, 2026
ba46ec9
docs: V17 — nested members reached only through the applicable chain
claude Oct 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 13 additions & 2 deletions docs/DIRECTORY-SIMULATION-POC.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -491,8 +491,19 @@ no-population-intermediate rule.
nested mail-enabled groups only (V19). A grant to a group that is not
mail-enabled is a violation.

Until V19's expansion lands, a grant to a group reaches only the
group's direct members.
V19's expansion has shipped (lance-graph #1458, #1463):
`View::security_identifiers` gives the security-enabled SID chain and
`groups_transitive_through` the mail-enabled chain, so a grant to a
group reaches nested members only through the chain that applies to
the right.

**Under review (2026-10-11, not yet ruled):** the per-right trustee
kinds above conflict with the Microsoft cmdlet reference on three
points. These are FullAccess with non-mail security groups
on-premises, SendAs in Exchange Online, and `GrantSendOnBehalfTo`
needing a mail-enabled principal. The conflict concerns which trustee
may be named, not how membership passes a right down. See lance-graph
`.claude/board/entries/2026-10-11-coresearch-instance-authz.md` (X14).
- **Denies follow ACE precedence.** Exchange allows deny entries on
FullAccess, and Active Directory allows them on SendAs. Each entry
keeps whether it is inherited (`IsInherited` in
Expand Down
Loading