Copied
ADR-ADMIN-001 · apps/admin · Ratified

ADR-ADMIN-001: Capability-Based Admin Authorization & Tiered Step-Up Freshness

Why administrative mutations resolve permissions from a database AdminProfile on every request and require step-up re-authentication.

← All ADRs · Gate: pnpm run admin:report-security-drift:strict (0 findings across 309 files)

Context

Checking coarse role strings (if (role === "ADMIN")) in session tokens leaves administrative surfaces vulnerable to stale tokens and privilege creep.

Decision

  1. Resolve AdminActor and AdminRole from the database AdminProfile on every mutation inside safeAction.
  2. Enforce granular AdminCapability checks (OVERRIDE_VERIFICATION, RELEASE_ESCROW).
  3. Require recent re-authentication within strict Tier 1 or Tier 2 freshness windows for high-risk mutations.

Consequences

Suspending an AdminProfile revokes authority across the entire platform immediately.