ADR 0013 — Platform super-admin acts as org-admin of the target org

• Status: Accepted (2026-10-23, owner decision after the security review)
• Refines: ADR 0002, ADR 0003
• Code: ddx-api/src/tenancy/org-slug.guard.ts, ddx-api/src/auth/**, auth migration platform_role

Context

super-admin was assignable as an org role and granted every org (review finding C2).

Decision

• super-admin is a PLATFORM role on the user (platformRole), not an org role. Org APIs cannot assign it; ORG_ROLES does not list it.
• A platform super-admin has full access in every org, acting as org-admin of the TARGET org (never its home-org roles). OrgSlugGuard resolves the :orgSlug org and those roles BEFORE RolesGuard runs. Writes in an org the user is not a member of are audited.
• A member of a non-active org passes on that org's slug with that org's roles.

Consequences

• Guard order: CredentialGuard → ClientThrottlerGuard → OrgContextGuard → OrgSlugGuard → RolesGuard.
• The seed marks the super-admin@<org>.test users with platformRole and joins them as org-admin (setup.md §7).

---

Last reconciled: 2026-10-23 · task 043