test(assistant): document self-service approval access

2026-03-30 12:20:55 +02:00
parent c9a35452dc
commit d3ad350821
2 changed files with 140 additions and 0 deletions
@@ -218,6 +218,16 @@ Reasoning:
 - `listAssignable` is an operational lookup for delegation and assignment flows, which fits manager and admin audiences
 - user administration and effective-permission inspection expose high-sensitivity identity and authorization state and therefore should remain admin-only

+### `packages/api/src/router/assistant.ts`
+
+- `listPendingApprovals`: `self-service`
+- `chat`: authenticated shell with tool-level audience enforcement
+
+Reasoning:
+
+- `listPendingApprovals` reads pending approvals by `ctx.dbUser.id`, so it is a self-service view of the caller's own approval queue
+- `chat` requires authentication, but the effective data audience is enforced by assistant tool selection and backing router permissions rather than by a single broad router audience on the chat endpoint itself
+
 ## Assistant Parity Rule

 - assistant tool visibility must never widen the audience of the backing router