Global, unlimited-depth member groups managed by the platform super
admin (requirement 3.1-3.3). Stores membership + nesting only, never
permission data; exposes user -> ancestor-closed group set.
- MemberGroup: soft delete via archivedAt; parentId FK RESTRICT.
Deleting a group cascade-soft-deletes its whole subtree as an
application operation, not a DB cascade.
- MemberGroupMembership: user<->group many-to-many, revokedAt soft
delete, user/group indexed for resolution hot path.
- MemberGroupClosure: transitive closure (depth-0 self rows) for
one-join ancestor/descendant resolution; maintained on
create/reparent with a cycle guard.
Permission side (GROUP principal, FOLDER resource, grant inheritance)
is deferred. This principal is deliberately not org-scoped and will
need ADR-0028 to supersede the ADR-0020 cross-org invariant before the
GROUP principal ships.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
白