🏗️ Architecture: What is the correct user tier hierarchy (L0-L4) and how shou...

Date: 2026-03-12
Time: 18:11:23 UTC
Session: gspace1-209.2
Agent: angular
Confidence: 97%
Status: ✅ Documented

📋 Decision Context

Question:

What is the correct user tier hierarchy (L0-L4) and how should it map to SystemRoles?

Task: Fix user tier hierarchy to place executives at L0

🎯 Decision Made

Chosen:

L0: executive (90) — founders/C-suite only. L1: developer (80), admin (60) — GoGrab internal. L2: space_builder, space_admin — managers (40). L3: space_user — editors (20). L4: platform_user — viewers (10). System (100) is non-human automation only.

Options Considered:

1. Keep L0=developer/admin as-is (wrong — violates founder's intent)
2. Move executive to L0, shift everything down by one tier (correct)
3. Create a separate 'owner' tier above executive (over-engineering — executive is sufficient for 2 founders)

💭 Reasoning

Root cause: A Cursor agent in Session ~52 (commit 3146ee998, Feb 19) incorrectly placed 'developer, admin' at L0 when defining the tier hierarchy comments in auth.types.ts. The executive role was later added to the backend ROLE_HIERARCHY (commit dfffa29f6, Mar 4) at level 90 but the tier comments and frontend UserRole type were never updated to reflect the correct hierarchy. The founder's intent was always: executives at the top (they control Vitto's core values, directives, and strategic decisions), developers/admins below (they build and operate but shouldn't modify identity/governance). This misalignment meant any authenticated user could create executive instructions (no @Roles guard), and the frontend couldn't even represent the executive role.

📁 Files Involved

• libs/libs-ui/auth-ui/src/lib/models/auth.types.ts
• libs/libs-api/auth-core/src/lib/auth-core.constants.ts
• libs/libs-api/auth-core/src/lib/guards/roles.guard.ts

🔗 Related

• Decision ID: dev_1773339083867_uy3tzq1
• Session: 209
• Workspace: gspace1

Auto-generated by MCP Smart Consolidation