Architecture decision records¶
Each record captures one decision: the context that forced it, the options considered, and the consequences we accepted. Records are immutable once accepted; a changed decision gets a new record that amends or supersedes the old one. Proposals that precede decisions live in ../rfcs/.
ADR-0001 to ADR-0009 record the decisions D1 to D9 of lattice RFC-0001, the design grantr implements, and ADR-0010 onwards the decisions made building it. lattice's own decisions, such as how it checks and releases every package, are lattice's ADRs.
| ADR | Title | Status |
|---|---|---|
| 0001 | The hook hears the action | Accepted |
| 0002 | Grants down to threads and artifacts | Accepted |
| 0003 | Visible to the workspace unless restricted | Accepted, amended by 0024 |
| 0004 | An agent turn acts for its user | Accepted |
| 0005 | A user's tenants from grantr's memberships | Accepted |
| 0006 | What v0.1 includes | Accepted |
| 0007 | An append-only audit log | Accepted, amended by 0033 |
| 0008 | grantr's own model, with OpenFGA-shaped ports | Accepted |
| 0009 | A deployment-wide operator role | Accepted, amended by 0014 and 0019 |
| 0010 | Commands bounded by what their maker holds | Accepted |
| 0011 | Built-in roles over the catalogs | Accepted, amended by 0019, 0022 and 0023 |
| 0012 | Every item an access names, and hooks typed by their actor | Accepted |
| 0013 | Transactions by tenant, and one audit log | Accepted, amended by 0016 and 0033 |
| 0014 | An operator enters a tenant by granting themselves | Accepted, amended 2026-10-16 |
| 0015 | A check writes nothing | Accepted, amended by 0024 |
| 0016 | The SQL adapter | Accepted, amended by 0024 |
| 0017 | The admin API | Accepted |
| 0018 | Telemetry through the OpenTelemetry API | Accepted |
| 0019 | Runtime actions, and the application role | Accepted, amended by 0022 and 0025 |
| 0020 | The rule role | Accepted, amended by 0029 |
| 0021 | The deployment's own tools | Accepted, amended by 0025 |
| 0022 | A tenant's members list its workspaces | Accepted |
| 0023 | portalr's admin reads | Accepted |
| 0024 | Who sees a restricted item | Accepted |
| 0025 | The application lists tenants and workspaces, and writes for its code rules | Accepted, amended by 0027 and 0029 |
| 0026 | Row-level security under the scoping | Accepted, amended by 0033 |
| 0027 | The application installs the rules people accept | Accepted |
| 0028 | A principal's id can't pass for the libraries' actors | Accepted |
| 0029 | A stored rule acts as itself, in its own workspace | Accepted |
| 0030 | The audit log, read by type and by actor | Accepted |
| 0031 | The catalog, read | Accepted |
| 0032 | The audit log, read from its end | Accepted |
| 0033 | A tenant's creation, in the deployment's log | Accepted |
| 0034 | Integrations switched per tenant and workspace, in grantr's table, audited | Accepted |
To add a record, copy lattice's ADR template to the next number and add a row above.