[rubenvdlinde]

An OpenSpec change for a new authorization match operator, $memberOf.

shillinq needs "a bookkeeper may only read rows of administrations they are a member of". Match rules know $userId, $user.groups, $organisation and $now, but cannot look up the caller's rows in a membership schema, so per-administration isolation cannot be declared today.

{ "administrationId": { "$memberOf": { "schema": "administration-membership", "property": "administrationId", "match": "userId", "where": { "role": { "$in": ["boekhouder"] } }, "current": { "from": "validFrom", "until": "validUntil" } } } }

• Resolved by the one shared token resolver (ConditionMatcher::resolveDynamicValue()) into $in, so list, count, single-object verdict, property rules and deny rules read the same set (ADR-011).
• The list predicate sits in the SQL WHERE, so pagination and counts stay exact.
• Read once per request per caller and operand; every failure denies.
• Fits hydra ADR-023 Rule 1 (data RBAC gaps are fixed in OpenRegister) and ADR-031 (declared in the schema).

Files: openspec/changes/access-follows-membership/ (proposal, design, tasks, rbac-scopes delta). The implementation follows on separate branches.

AI disclosure: drafted with Claude Code (claude-opus-5-5).

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/openregister @ 1682a3f

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
test-l10n-parity		✅
format		✅
check-schema-l10n		✅
composer			✅	✅ 173/173
npm			✅	✅ 648/648
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					⏭️ not run for this diff — no file in this diff matches the code globs, and none carries a source extension — the heavy tier has nothing to decide about it.
Newman					✅ 714/714
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅

---

Quality workflow — 2026-10-21 08:48 UTC

Download the full PDF report from the workflow artifacts.