Block authoring apply on RBAC and privacy guards

packages/security-core/src/security_core/__init__.py

@@ -11,6 +11,7 @@ class Permission(str, Enum):
     WRITE_KNOWLEDGE = "WRITE_KNOWLEDGE"
     MANAGE_TASKS = "MANAGE_TASKS"
     MANAGE_USERS = "MANAGE_USERS"
+    APPLY_AUTHORING_CHANGE = "APPLY_AUTHORING_CHANGE"
     ADMIN = "ADMIN"
 
 
@@ -126,6 +127,7 @@ def default_rbac_policy() -> RbacPolicy:
                     Permission.READ_GRAPH,
                     Permission.WRITE_KNOWLEDGE,
                     Permission.MANAGE_TASKS,
+                    Permission.APPLY_AUTHORING_CHANGE,
                 },
             ),
             "viewer": Role(role_id="viewer", name="Viewer", permissions={Permission.READ_GRAPH}),

packages/security-core/tests/test_security_core.py

@@ -18,6 +18,7 @@ def test_rbac_allows_permissions_from_granted_role():
         Permission.READ_GRAPH,
         Permission.WRITE_KNOWLEDGE,
         Permission.MANAGE_TASKS,
+        Permission.APPLY_AUTHORING_CHANGE,
     }