Slice 3 — Connections & Entity Profiles

HITL verification · 2026-07-11 · PR #766 (stacked on #765) · preview refreshed at localhost:4180 · 15/15 tests verified independently

0 / 6 verified

What this slice is. The access-control surface — where "who sees what" stops being invisible policy and becomes something you can read, change, and audit. The 8×4 matrix with cascade inheritance (group → company → role → person), sensitive categories behind approval, one-click revoke that actually revokes, and an access log that already contains the grants you made from Messages in slice 2. This is the trust machinery of the entire platform, visible.

The checklist

1 · The graph is legible. Open /demo/distributor/connections.TP-CON-2

Companies grouped (team · platform · external), each with connection state — Solterra shows pending, Alpenlab not connected.

2 · Entity profile ties the world together. Open Atlas Verde's profile → Relationship tab.TP-CON-1

Open items link to the late PO on the spine and the slice-2 thread; history shows message events and the access grants you made earlier; documents listed.

3 · The matrix ripples. Access tab: change a non-sensitive category (e.g. Logistics) at the Role tier.RBAC-2

Toast tells you it ripples to everyone in the role who hasn't overridden; person-tier overrides survive.

4 · Sensitive means staged. Try granting Pricing to an external contact.RBAC-4

Nothing applies — a drafted approval request to the founder appears as pending. Approve it → applies role-wide.

5 · Revoke means gone. Revoke a connected company (confirmation shows what gets cut), then check their lens.SPINE-4

Their projection loses the shared objects immediately — no stale window. (CI-enforced too.)

6 · One audit stream + clean console. Open the access log; devtools open throughout.SPINE-3 · SPINE-7

Messages grants, matrix changes, approvals, revokes — one stream, attributed. Zero console errors.

Verdict: "slice 3 pass" / "slice 3 redo: [what you saw]". Schema additions already filed to Allan on #764: app.connection, app.access_policy, app.access_approval_request.

In flight: slice 4 (Data Foundation — conflict queue, cascade, needs-info routed into your slice-2 threads, trust meter) building now · slice 5 (demo DB: DDL + seed from the world) queued last so it captures every shape. · Clay ⇄ Claude · VP Completion Campaign