[{"data":1,"prerenderedAt":569},["ShallowReactive",2],{"navigation":3,"doc-/architecture/authorization":217,"docs-all-paths":514},[4,19,39,63,87,111,127,195,211],{"title":5,"path":6,"stem":7,"children":8},"Welcome","/welcome","01.welcome",[9,11,15],{"title":5,"path":6,"stem":10},"01.welcome/index",{"title":12,"path":13,"stem":14},"Astar とは（5分）","/welcome/product-in-5-min","01.welcome/01.product-in-5-min",{"title":16,"path":17,"stem":18},"事業文脈","/welcome/business-context","01.welcome/02.business-context",{"title":20,"path":21,"stem":22,"children":23},"Getting Started","/getting-started","02.getting-started",[24,27,31,35],{"title":25,"path":21,"stem":26},"はじめかた","02.getting-started/index",{"title":28,"path":29,"stem":30},"リポジトリ取得と環境構築","/getting-started/repo-setup","02.getting-started/01.repo-setup",{"title":32,"path":33,"stem":34},"日々の開発ループ","/getting-started/dev-loop","02.getting-started/02.dev-loop",{"title":36,"path":37,"stem":38},"検証の 4 層","/getting-started/verification-tiers","02.getting-started/03.verification-tiers",{"title":40,"path":41,"stem":42,"children":43},"Architecture","/architecture","03.architecture",[44,47,51,55,59],{"title":45,"path":41,"stem":46},"アーキテクチャ","03.architecture/index",{"title":48,"path":49,"stem":50},"マルチテナンシーと RLS","/architecture/multi-tenancy-rls","03.architecture/01.multi-tenancy-rls",{"title":52,"path":53,"stem":54},"認可モデル","/architecture/authorization","03.architecture/02.authorization",{"title":56,"path":57,"stem":58},"AI サブシステム","/architecture/ai-subsystem","03.architecture/03.ai-subsystem",{"title":60,"path":61,"stem":62},"データモデル","/architecture/data-model","03.architecture/04.data-model",{"title":64,"path":65,"stem":66,"children":67},"Backend","/backend","04.backend",[68,71,75,79,83],{"title":69,"path":65,"stem":70},"バックエンド","04.backend/index",{"title":72,"path":73,"stem":74},"層構造","/backend/layering","04.backend/01.layering",{"title":76,"path":77,"stem":78},"規約","/backend/conventions","04.backend/02.conventions",{"title":80,"path":81,"stem":82},"テスト","/backend/testing","04.backend/03.testing",{"title":84,"path":85,"stem":86},"マイグレーション","/backend/migrations","04.backend/04.migrations",{"title":88,"path":89,"stem":90,"children":91},"Frontend","/frontend","05.frontend",[92,95,99,103,107],{"title":93,"path":89,"stem":94},"フロントエンド","05.frontend/index",{"title":96,"path":97,"stem":98},"モジュール内部構造","/frontend/module-anatomy","05.frontend/01.module-anatomy",{"title":100,"path":101,"stem":102},"API アクセスの一本道","/frontend/api-access-chain","05.frontend/02.api-access-chain",{"title":104,"path":105,"stem":106},"i18n","/frontend/i18n","05.frontend/03.i18n",{"title":108,"path":109,"stem":110},"デザインシステム","/frontend/design-system","05.frontend/04.design-system",{"title":112,"path":113,"stem":114,"children":115},"Go Agent And Cli","/go-agent-and-cli","06.go-agent-and-cli",[116,119,123],{"title":117,"path":113,"stem":118},"Go agent と CLI","06.go-agent-and-cli/index",{"title":120,"path":121,"stem":122},"Go agent","/go-agent-and-cli/go-agent","06.go-agent-and-cli/01.go-agent",{"title":124,"path":125,"stem":126},"CLI","/go-agent-and-cli/cli","06.go-agent-and-cli/02.cli",{"title":128,"path":129,"stem":130,"children":131},"Modules","/modules","07.modules",[132,135,139,143,147,151,155,159,163,167,171,175,179,183,187,191],{"title":133,"path":129,"stem":134},"モジュール","07.modules/index",{"title":136,"path":137,"stem":138},"テーブル","/modules/table","07.modules/01.table",{"title":140,"path":141,"stem":142},"ドキュメントツリー","/modules/document","07.modules/02.document",{"title":144,"path":145,"stem":146},"AIチャット","/modules/ai","07.modules/03.ai",{"title":148,"path":149,"stem":150},"認証・権限","/modules/auth","07.modules/04.auth",{"title":152,"path":153,"stem":154},"AI取込","/modules/organize","07.modules/05.organize",{"title":156,"path":157,"stem":158},"ストレージ","/modules/storage","07.modules/06.storage",{"title":160,"path":161,"stem":162},"NAS同期","/modules/sync","07.modules/07.sync",{"title":164,"path":165,"stem":166},"ワークスペース","/modules/workspace","07.modules/08.workspace",{"title":168,"path":169,"stem":170},"テナントとメンバーシップ","/modules/tenant-membership","07.modules/09.tenant-membership",{"title":172,"path":173,"stem":174},"検索","/modules/search","07.modules/10.search",{"title":176,"path":177,"stem":178},"表示ビュー","/modules/display","07.modules/11.display",{"title":180,"path":181,"stem":182},"テンプレート","/modules/template","07.modules/12.template",{"title":184,"path":185,"stem":186},"メール","/modules/mail","07.modules/13.mail",{"title":188,"path":189,"stem":190},"電話","/modules/phone","07.modules/14.phone",{"title":192,"path":193,"stem":194},"リアルタイム","/modules/realtime","07.modules/15.realtime",{"title":196,"path":197,"stem":198,"children":199},"Infra And Deploy","/infra-and-deploy","08.infra-and-deploy",[200,203,207],{"title":201,"path":197,"stem":202},"インフラとデプロイ","08.infra-and-deploy/index",{"title":204,"path":205,"stem":206},"環境の種類","/infra-and-deploy/environments","08.infra-and-deploy/01.environments",{"title":208,"path":209,"stem":210},"セルフホスト構成","/infra-and-deploy/self-host","08.infra-and-deploy/02.self-host",{"title":212,"path":213,"stem":214,"children":215},"docs-map","/docs-map","09.docs-map/index",[216],{"title":212,"path":213,"stem":214},{"id":218,"title":52,"body":219,"description":508,"extension":509,"meta":510,"navigation":511,"path":53,"seo":512,"stem":54,"__hash__":513},"docs/03.architecture/02.authorization.md",{"type":220,"value":221,"toc":496},"minimark",[222,225,234,239,242,253,260,264,271,282,288,291,297,302,369,394,397,401,412,416,427,455,459,466,469,472],[223,224,52],"h1",{"id":52},[226,227,228,229,233],"p",{},"Astar の認可は、Discord のようなロール/権限モデルを土台にしつつ、",[230,231,232],"strong",{},"どこでチェックするか","については 2026-07-01 に大きな再設計（primitives-only 認可）を経ています。このページは現行モデルの考え方を説明します。個々のツール・エンドポイントの認可要件の網羅表は生成ドキュメントに譲ります。",[235,236,238],"h2",{"id":237},"土台-ロールと権限ルール","土台: ロールと権限ルール",[226,240,241],{},"権限の割り当て自体は Discord ライク なロールモデルです。",[243,244,249],"pre",{"className":245,"code":247,"language":248},[246],"language-text","PermissionRule:\n  resource: ResourceType (TABLE, DOCUMENT, WORKSPACE, ...)\n  action: Action (VIEW, CREATE, UPDATE, DELETE, ...)\n  scope: Scope (WORKSPACE, SPECIFIC_RESOURCE)\n  effect: Effect (ALLOW, DENY)\n\nDynamicRole:\n  name: \"プロジェクトマネージャー\"\n  permissions: [PermissionRule, ...]\n  position: 1  # 優先順位\n","text",[250,251,247],"code",{"__ignoreMap":252},"",[226,254,255,256,259],{},"メンバーにロールを割り当て、ロールに権限ルールを紐付ける、という一般的な形です。",[230,257,258],{},"AI も人間と同じ権限系に従います"," — AI メンバーやサービスアカウントにもロールを割り当てます。ここまでは従来通りです。",[235,261,263],{"id":262},"primitives-only-認可2026-07-01","primitives-only 認可（2026-07-01）",[226,265,266,267,270],{},"再設計されたのは「",[230,268,269],{},"この権限ルールをどの層でチェックするか","」です。",[226,272,273,274,277,278,281],{},"以前は pack apply・template apply・import・export のような「機能単位の操作」ごとに、",[250,275,276],{},"@AuthorizesInBody"," という compound マーカーや、",[250,279,280],{},"node.view.all"," のような capability-wide ゲートで個別に認可する設計でした。施主はこれを明確に拒否しました:",[283,284,285],"blockquote",{},[226,286,287],{},"「何のためのnodeなんだよ。packってなんだよ。ゴミ」— pack は node の集合にすぎない。node であるなら、他の node と同じように per-resource に認可すべき。",[226,289,290],{},"この一言で、機能単位の認可という概念そのものが撤去されました。",[226,292,293,296],{},[230,294,295],{},"現行原理",": 認可は、リソースプリミティブ（record / document / table property / dataset / tag / template / share link / screen placement / embedding など）の**唯一の gated プリミティブメソッド（membrane）**の上にのみ存在します。プリミティブより上の層（adapter・orchestrator・feature service・tool body）は認可ゲートを一切宣言しません。",[298,299,301],"h3",{"id":300},"プリミティブ-vs-オーケストレータ","プリミティブ vs オーケストレータ",[303,304,305,321],"table",{},[306,307,308],"thead",{},[309,310,311,315,318],"tr",{},[312,313,314],"th",{},"種別",[312,316,317],{},"定義",[312,319,320],{},"ゲート",[322,323,324,352],"tbody",{},[309,325,326,332,335],{},[327,328,329],"td",{},[230,330,331],{},"プリミティブ (membrane)",[327,333,334],{},"単一リソース型のインスタンスを識別子で指定して生成/変更/削除/読み取りする最下層のサービスメソッド。他のプリミティブを呼ばない",[327,336,337,340,341,340,344,347,348,351],{},[250,338,339],{},"canAccessResource"," / ",[250,342,343],{},"canAccessRecord",[250,345,346],{},"canAccessDataset"," などの ",[250,349,350],{},"@PreAuthorize"," を1つだけ持つ",[309,353,354,359,362],{},[327,355,356],{},[230,357,358],{},"オーケストレータ",[327,360,361],{},"2つ以上のプリミティブ（または他のオーケストレータ）を合成する feature service / tool body",[327,363,364,365,368],{},"認可ゲートを一切持たない（",[250,366,367],{},"isAuthenticated()"," のみ）",[226,370,371,374,375,378,379,381,382,385,386,389,390,393],{},[250,372,373],{},"pack_form_apply"," を例にすると、以前は ",[250,376,377],{},"hasPermissionRule('node.view.all')"," という「pack を触れる人は全nodeを読める」という all-or-nothing なゲートを1つ持っていました。これは per-folder の粒度の権限付与を無視してしまう欠陥でした。現行設計では ",[250,380,373],{}," 自体はゲートを持たない thin orchestrator になり、内部で呼ぶ ",[250,383,384],{},"recordService.list","（table READ プリミティブ）と ",[250,387,388],{},"storageAwareDocumentService.createDocument","（node CREATE プリミティブ）がそれぞれ per-resource に認可します。読めない table があれば読み取りの時点で、書けない folder があれば作成の時点で、自動的に弾かれます。",[230,391,392],{},"pack という認可単位そのものが存在しなくなった","のがポイントです。",[226,395,396],{},"同じロジックが template apply・import・export・resource-set apply にも当てはまります。これらは「既存リソースを読み、node/table/record を生成するオーケストレータ」という同じ形なので、認可は各プリミティブに transitive に効きます。",[298,398,400],{"id":399},"読み取り-listtree-の認可","読み取り (list/tree) の認可",[226,402,403,404,407,408,411],{},"単一リソースの読み取りは ",[250,405,406],{},"canAccessResource(id, 'NODE', 'view')"," のような1本の SpEL 式で表現できますが、一覧・ツリー取得は複数行を返すため単一式に収まりません。この場合はプリミティブの list メソッドが内部で ",[250,409,410],{},"AuthorizationService.filterAccessibleResourceIds"," を呼び、アクセス可能な id だけを返します。これは「機能特別扱いの body 認可」ではなく、list プリミティブの内在的契約として扱われます。",[235,413,415],{"id":414},"deny-の表現-403-と-404-の使い分け","deny の表現: 403 と 404 の使い分け",[226,417,418,419,422,423,426],{},"ゲートプリミティブは deny を ",[250,420,421],{},"false"," で返すだけで、",[250,424,425],{},"ResourceNotFoundException"," を throw しません。HTTP としての表現は handler 層で一元化されています。",[428,429,430,438,448],"ul",{},[431,432,433,434,437],"li",{},"GET（読み取り） → ",[230,435,436],{},"404","（情報秘匿。「存在するが権限が無い」と教えない）",[431,439,440,441,444,445,447],{},"非GET（書き込み） → ",[230,442,443],{},"403","（",[250,446,350],{}," の権限判定失敗）",[431,449,450,451,454],{},"クロステナントのリソースは常に「存在しない」扱い（",[452,453,48],"a",{"href":49}," 参照）",[235,456,458],{"id":457},"ai-エージェントも同じ認可を通る","AI エージェントも同じ認可を通る",[226,460,461,462,465],{},"MCP 経由でツールを呼ぶ AI エージェント（内製・BYO 問わず）も、REST API を叩く人間のユーザーも、",[250,463,464],{},"CustomMethodSecurityExpressionRoot"," 上の同じプリミティブゲートを通ります。AI メンバーはサービスアカウント（スコープ付きトークン）として同一の権限系に乗り、ロールを割り当てられます。astar CLI も同じツール定義・同じ認可経路です。",[235,467,468],{"id":468},"深掘り資料",[226,470,471],{},"このページはモデルの「考え方」に絞っています。個々のツール・エンドポイントの認可要件を1つずつ確認したい場合は、以下の生成ドキュメントを参照してください（ハンド編集禁止・アノテーションから自動生成）。",[428,473,474,484,490],{},[431,475,476,479,480,483],{},[250,477,478],{},"docs/authorization/tool-access-catalog.md"," — 全 MCP ツールの ",[250,481,482],{},"capability"," / gate SpEL / 例外理由の一覧",[431,485,486,489],{},[250,487,488],{},"docs/authorization/membrane-migration-ledger.md"," — primitives-only 移行前の調査記録（P-0 inventory）。移行の経緯を追いたいときの一次資料",[431,491,492,495],{},[250,493,494],{},"docs/designs/2026-07-01-authorization-primitives-only.md"," — 本ページの元になった詳細設計。BUCKET A/B（principal の有無によるゲート回避の要否）や migration phase の全量はここにあります",{"title":252,"searchDepth":497,"depth":497,"links":498},2,[499,500,505,506,507],{"id":237,"depth":497,"text":238},{"id":262,"depth":497,"text":263,"children":501},[502,504],{"id":300,"depth":503,"text":301},3,{"id":399,"depth":503,"text":400},{"id":414,"depth":497,"text":415},{"id":457,"depth":497,"text":458},{"id":468,"depth":497,"text":468},"primitives-only 認可（2026-07-01 再設計）。ゲートはリソースプリミティブにのみ存在し、機能単位の認可特別扱いは存在しない。","md",{},{"title":52},{"title":52,"description":508},"awIQtIlTUT7_37iMGj-IFz5UczU1sNkFRk3AxKiXmtY",[515,517,518,520,521,522,523,524,525,526,527,528,530,531,532,533,534,536,537,538,539,540,542,544,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,564,565,566,567],{"path":13,"title":516},"Astar とは何か（5分で）",{"path":17,"title":16},{"path":6,"title":519},"ようこそ",{"path":29,"title":28},{"path":33,"title":32},{"path":37,"title":36},{"path":21,"title":25},{"path":49,"title":48},{"path":53,"title":52},{"path":57,"title":56},{"path":61,"title":60},{"path":41,"title":529},"システムアーキテクチャ",{"path":73,"title":72},{"path":77,"title":76},{"path":81,"title":80},{"path":85,"title":84},{"path":65,"title":535},"バックエンドガイド",{"path":97,"title":96},{"path":101,"title":100},{"path":105,"title":104},{"path":109,"title":108},{"path":89,"title":541},"フロントエンドガイド",{"path":121,"title":543},"Go agent — NAS 同期エージェント",{"path":125,"title":545},"astar CLI",{"path":113,"title":117},{"path":137,"title":136},{"path":141,"title":140},{"path":145,"title":144},{"path":149,"title":148},{"path":153,"title":152},{"path":157,"title":156},{"path":161,"title":160},{"path":165,"title":164},{"path":169,"title":168},{"path":173,"title":172},{"path":177,"title":176},{"path":181,"title":180},{"path":185,"title":184},{"path":189,"title":188},{"path":193,"title":192},{"path":129,"title":563},"モジュール索引",{"path":205,"title":204},{"path":209,"title":208},{"path":197,"title":201},{"path":213,"title":568},"docs/ 地図",1785452454952]