REL-HUM-ROL: Human ↔ Role

Stable ID: REL-HUM-ROL
Entities: HUM (Human) ↔ ROL (Role)
Relationship status: implemented

Audited relationship

Human roles are derived through group membership.

Design

Canonical Subject-role edge. Humans hold Roles via Group membership only — no per-Agent dimension. Cardinality: M:N — one Human holds many Roles (by joining multiple Groups, e.g. owners and members), one Role is held by many Humans (every member of the owners Group holds owner). Agents do not hold Roles — Roles describe what a Human can do on the Server, not how they relate to a specific Agent.

Mechanism is through Group: a Human acquires a Role by joining a Group that carries that Role (see REL-GRP-ROL). Joining a Group is exclusively a Human act, so "holding a Role" is composed from the Human's Group memberships. But the Subject fact is direct: "this Human holds Role R." Effective permissions use the Capability union across all Groups, not a per-Agent role pick.

Implementation

Canonical path in code: users → group_members → groups → group_roles → roles. The group_roles junction yields the Role slug(s) for each Group; group_members only confirms membership. Runtime entries in packages/trust/src/queries.ts:

• getUserMemberships(userId) → [{ groupId, groupType, groupLabel, roleSlug }]
• findUserHighestRoleSlug(userId) → slug | null — highest rung across all Group memberships for display / legacy actorRole.
• findUsersWithCapability("approve_destructive_actions") → userId[] — used by routeApproval to resolve prove_it approvers server-wide (replaces per-Group findUsersWithRoleInGroup on an ownership group).

A Group carries a set of Roles (the group_roles junction), and all members of that Group inherit that whole set. Non-members resolve to guest; the stranger sentinel slug is retired.

Verification state

This article remains at the original relationship granularity for AI and maintainer use. Its current-versus-target classification was reconciled before migration; public code-anchor verification remains in progress against Nautilo 4b3ea604.