Repository navigation
Add an off switch for revoking permissions in the built-in role sync #1430
Description
Tracking item for #1426 (requested in review, may land inside that PR). Once the sync becomes authoritative, any host that registers IdentityModule without every other module would revoke the missing modules' permissions from Admin in every tenant on startup.
Guards:
- skip removal when a role's target set is empty
Identity:PermissionSync:RemoveRevoked(defaulttrue) to turn removal off for partial hosts- document both in the docs authorization page
Close this when #1426 merges with the guards.
Activity
iammukeshm commentedon Nov 3, 2026
Done in #1426.
PermissionSyncOptions:RemoveRevoked(defaulttrue) turns the removal side of the built-in role sync off. With it set tofalse, the sync only adds permissions and logs once at startup that it's running add-only. It's meant for hosts that load only some modules, where a partial permission catalog would otherwise look like revocations. It's documented on the Authorization page and in the production checklist.