Semantic access discovery and consumers

FAI-642 connects authoritative access metadata to semantic discovery and request execution. Resource RBAC remains necessary: semantic permission does not grant document sharing, authoring, or access to another project.

Discovery authority

The immutable SemanticModel carries dataset access filters and dataset/member required grants. FAI-639 compiles their transitive relationship and metric dependencies. Discovery uses these compiled requirements and the same typed decision as query admission, not a second policy interpreter.

The shared query consumer returns sorted dataset, dimension-binding, and metric records with required grants, dependency/filter datasets, ownership, and qualified policy identity. Denied assets are omitted; direct references receive the same decision. Missing models, unknown members, mismatched source fingerprints, and invalid authority never become public assets.

Request authorization

Application composition supplies the server instance, exact serving scope, and authenticated principal. Access resolves the live principal and active group closure with registry, control, and effective assignments in one owned PostgreSQL repeatable-read, read-only transaction. Caller-owned transactions are not accepted by this resolver.

The direct-assignment adapter uses existing canonical values and opaque evidence. It does not accept browser claims or invent trusted-provider evidence. Publication identities, development bypass, and workload admission identities do not substitute for an authenticated semantic principal.

Each consumer pins policy/decision identity. Fresh observations must still match it, preventing one response or plan from combining different valid authorization snapshots. Changed, disabled, tombstoned, or malformed authority fails closed. Discovery-only consumers cannot produce executable plans.

Execution boundary

Request planners retain the activation-owned compiled model and consume the existing FAI-639 predicates. SecurityBarrier enforcement remains before scans participate in joins and aggregation.

Materialization requires a bound consumer for protected queries, compares its instance/project/environment/generation/model identity to the runtime, and checks private admission provenance plus exact PlanIR, SQL, arguments, and columns before execution. Arrow delivery rechecks authority before releasing schemas and batches; buffered results are rechecked after database execution before ownership is transferred to the caller. A copied or re-rendered altered graph is not admission.

Dashboard queries, semantic API queries/explain, Explore, agent/MCP query paths, and raw-value/suggestion paths converge on these shared boundaries. Catalog and member projections are authorization-filtered. Whole-document projections that cannot safely express partial visibility deny the entire projection rather than expose denied members. Source/Model previews remain separately resource-authorized authoring capabilities, never semantic bypasses.

Deliberately unsupported paths

Protected immutable-byte reuse and bundles without a proven request boundary fail closed. FAI-645 extends buffered dashboard-result reuse with complete policy/control identity and fresh admission validation at lookup, storage, and delivery boundaries. Reuse also requires exact, historically validated FAI-622 publication/policy evidence; missing evidence bypasses shared reuse rather than weakening authorization. Public result identity remains unchanged. Protected consumer composition requires canonical security audit persistence; a cached result cannot replace current authorization or its required audit evidence. Other unqualified reuse paths remain denied or bypassed.

Neutral activation verification must not fabricate a principal or skip planner admission. FAI-648 records the supported consumer combinations and FAI-649 activates that exact profile; combinations without named evidence remain fail closed. This boundary does not complete VAL-11, which remains Partial.