[flyer5200]

Changelog category

• New Feature

Changelog entry

• Allow administrators to grant application resources directly to individual users, in addition to role-based permissions.

Affected version

• 2026.4.0

Background

Granting an individual exception currently requires creating or modifying a role. This change lets administrators add selected application permissions directly to a user while retaining the user's role-based permissions.

Implementation

• Store tenant-scoped direct ALLOW grants with optional expiry, audit logging, authorization cache invalidation, account cleanup, and resource deletion protection. Existing authorization boundaries and step-up checks apply.
• Combine direct and role grants in authorization snapshots and the open API, preserving resource dependencies, disabled resources, and role DENY precedence. Direct grants do not confer delegation rights or participate in role-based separation-of-duty checks.
• Add an application-scoped user grant editor with role-derived permissions marked and locked, module folding, batch actions, and expiration. Improve role grant editing with the same tree controls.
• Extend effective-access inspection, explanations, and role-change simulations to the selected application, including direct grant sources and their effect on simulations.
• Update the OpenAPI contract, translations, documentation, and tests.

Validation

• Complete Java 21 test suite, coverage thresholds, Java bytecode checks, Checkstyle, SpotBugs, and PMD.
• Frontend unit tests (496 passed), production build, lint, OpenAPI type check, and Playwright tests (6 passed).
• Migration, permission manifest, localization, test mapping, and changed-file license and formatting checks.