docs(connectors): document ACL enforcement (PRO-3222 PRO-3223) by vorflux[bot] · Pull Request #334 · hydra-db/mintlify-docs

vorflux · 2026-10-26T19:20:05Z

Goal

Document how workspace owners and writers set per-connector ACL enforcement and how enforced reads use the authenticated caller.

Why

Soham's 13:25 UTC decision updates requirements-sheet rows 1 and 13. Owners and writers can change enforcement. Readers can see the current setting but cannot change it. API keys remain blocked.

Links

PRO-3222
PRO-3223
Session: https://hydradb.us1.vorflux.com/agent-sessions/773d1894-14b0-4274-80b8-806edfa3d751
Sits next to application PR: https://github.com/hydra-db/hydradb-application/pull/2937
Sits next to dashboard PR: https://github.com/hydra-db/dashboard-2.0/pull/760

Before and after

Before: documentation described ACL enforcement as owner-only.
After: workspace owners and writers can change enforce_acl in human dashboard sessions.
Readers can view the setting but cannot change it.
API keys cannot set the field.
Enforced content uses the authenticated caller. Non-enforced content keeps request-based ACL filtering.

What changed

Update connector creation and update guidance for owner and writer roles.
Document the exact 403 message: only workspace owners and writers can change ACL enforcement.
Document reader visibility and API-key restrictions.
Update the endpoint reference and OpenAPI contract wording.

Tests

make build passed.
npm run hygiene passed.
npm run verify:agents-endpoints passed.
jq empty api-reference/v2/openapi.json passed.
DCO and current CI checks passed at head 2ca136184b4bfeb3fec60b787ffbdda160091e5a.

Where to look

Connector setup: essentials/v2/connectors.mdx.
Access control: essentials/v2/access-control.mdx.
Create contract: api-reference/v2/endpoint/create-connector.mdx.
Update contract: api-reference/v2/endpoint/update-connector.mdx.
Generated contract: api-reference/v2/openapi.json.

Risks

Publish these docs with the coordinated application and dashboard changes.

Session Details

Session: View Session
Requested by: Soham Ratnaparkhi (soham@hydradb.com)
Address comments on this PR. Add (aside) to your comment to have me ignore it.

^{Need help on this PR? Tag @codesmith-bot with what you need.}

…O-3223) Signed-off-by: Vorflux AI <249966464+vorflux[bot]@users.noreply.github.com>

mintlify · 2026-10-26T19:20:09Z

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
cortex-ai	🟢 Ready	View Preview	Oct 28, 2026, 7:21 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

github-actions · 2026-10-26T19:20:18Z

✅ Mintlify Hygiene

No issues found.

Signed-off-by: Vorflux AI <249966464+vorflux[bot]@users.noreply.github.com>

greptile-apps · 2026-10-26T19:29:11Z

Confidence Score: 5/5

[Low impact] The documentation appears safe to merge, with a non-blocking mismatch between the guides and the generated API reference.

Findings

API reference contradicts the guides ▶

Summary

Documents per-connector ACL enforcement for workspace owners and writers.

Workspace owners and writers can switch ACL enforcement on for supported connectors.
Enforced connector reads use the authenticated caller's identity.

_{Reviews (8) · Last reviewed commit: "docs(acl): Drive group membership, key r..." · Reviewed by Greptile}

Signed-off-by: Vorflux AI <249966464+vorflux[bot]@users.noreply.github.com>

openhack-agent · 2026-10-26T19:32:00Z

✅ OpenHack Summary

Security review of docs(connectors): document ACL enforcement (PRO-3222 PRO-3223). 12 changed files; 0 findings at or above the low reporting threshold.

0 0 0 0

Confidence Score: 5/5

No reportable security findings were detected in this scan.

Security merge-readiness rubric: 1 = critical, 2 = high, 3 = medium, 4 = low, 5 = no reportable findings. This score reflects scan findings, not a guarantee of correctness or complete coverage.

Files Needing Attention: None

Important Files Changed

api-reference/v2/endpoint/connectors-overview.mdx (modified)
api-reference/v2/endpoint/create-connector.mdx (modified)
api-reference/v2/endpoint/fetch-content.mdx (modified)
api-reference/v2/endpoint/list-connector-providers.mdx (modified)
api-reference/v2/endpoint/list-documents.mdx (modified)
api-reference/v2/endpoint/query.mdx (modified)
api-reference/v2/endpoint/source-relations.mdx (modified)
api-reference/v2/endpoint/subgraph.mdx (modified)
api-reference/v2/endpoint/update-connector.mdx (modified)
essentials/v2/access-control.mdx (modified)
essentials/v2/connectors.mdx (modified)
essentials/v2/query.mdx (modified)

Last reviewed commit: 61a0788 · View review on OpenHack

TIP: Mention @openhack-agent in a PR comment to request a review or ask a question. Use @openhack-agent fix all for every finding, or @openhack-agent fix unresolved threads for open review threads only.

openhack-agent

OpenHack reviewed this commit. See the OpenHack Summary for the confidence score and fix actions.

Signed-off-by: Vorflux AI <249966464+vorflux[bot]@users.noreply.github.com>

vorflux · 2026-10-27T07:42:51Z

@greptile-apps Please review this current head against its focused stack-layer scope and report a score for this exact SHA.

vorflux · 2026-10-27T08:01:21Z

@greptile-apps Please review this current head against its focused stack-layer scope and report a score for this exact SHA.

Signed-off-by: SohamRatnaparkhi <92905626+SohamRatnaparkhi@users.noreply.github.com> Co-authored-by: Soham Ratnaparkhi <soham@hydradb.com>

SohamRatnaparkhi

Approved on Soham's behalf: Greptile 5/5 at head, CI green. Behaviour to be verified on staging.

… to autogen - Access Control: a Google Drive-only section on files shared with a group: what google_group_membership_resolves reports, why a false result keeps group-shared files restricted, and the fix (reconnect as a Workspace admin with Directory access). States that no other connector reports it. - Connectors: removing a member, or a member leaving, revokes every key they created in the workspace, and re-inviting restores none. A provider whose acl_supported HydraDB withdraws stops enforcing and keeps enforce_acl. - Update Connector: the 503 when the provider catalog cannot be read while enabling enforce_acl. - api-reference/v2/openapi.json goes back to main. The generated spec (#343) now carries acl_supported, acl_description and enforce_acl from the API's own annotations, so this PR no longer hand-edits it and the two do not conflict. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Soham Ratnaparkhi <soham@hydradb.com>

SohamRatnaparkhi

Re-approving after the follow-up commit 61a0788 (Drive group membership, key revocation, 503 on PATCH, spec left to autogen #343). Greptile 5/5 on this head; all checks green.

docs(connectors): document source permission enforcement (PRO-3222 PR…

569ca6b

…O-3223) Signed-off-by: Vorflux AI <249966464+vorflux[bot]@users.noreply.github.com>

mintlify Bot deployed to staging October 26, 2026 19:20

View deployment

mintlify Bot deployed to staging October 26, 2026 19:24

View deployment

fix(docs): validate permission examples (PRO-3222 PRO-3223)

8759e90

Signed-off-by: Vorflux AI <249966464+vorflux[bot]@users.noreply.github.com>

vorflux Bot force-pushed the vorflux/pro-3222-3223-connector-permissions-docs branch from 55d8bd8 to 8759e90 Compare October 26, 2026 19:25

vorflux Bot marked this pull request as ready for review October 26, 2026 19:25

mintlify Bot deployed to staging October 26, 2026 19:25

View deployment

greptile-apps Bot reviewed Oct 26, 2026

View reviewed changes

Comment thread api-reference/v2/endpoint/query.mdx Outdated

fix(docs): clarify ACL behavior outside enforced connectors (PRO-3223)

ce1768b

Signed-off-by: Vorflux AI <249966464+vorflux[bot]@users.noreply.github.com>

openhack-agent Bot reviewed Oct 26, 2026

View reviewed changes

mintlify Bot deployed to staging October 26, 2026 19:32

View deployment

mintlify Bot deployed to staging October 27, 2026 05:44

View deployment

docs(connectors): standardize ACL enforcement terms (PRO-3222 PRO-3223)

d94579d

Signed-off-by: Vorflux AI <249966464+vorflux[bot]@users.noreply.github.com>

vorflux Bot force-pushed the vorflux/pro-3222-3223-connector-permissions-docs branch from 869590a to d94579d Compare October 27, 2026 05:45

mintlify Bot deployed to staging October 27, 2026 05:45

View deployment

vorflux Bot changed the title ~~docs(connectors): document source permission enforcement (PRO-3222 PRO-3223)~~ docs(connectors): document ACL enforcement (PRO-3222 PRO-3223) Oct 27, 2026

vorflux Bot added 2 commits October 27, 2026 07:39

docs: simplify connector ACL contract

36bfdc6

Signed-off-by: Vorflux AI <249966464+vorflux[bot]@users.noreply.github.com>

docs: correct provider ACL field names

212f85d

Signed-off-by: Vorflux AI <249966464+vorflux[bot]@users.noreply.github.com>

mintlify Bot deployed to staging October 27, 2026 07:42

View deployment

mintlify Bot deployed to staging October 27, 2026 14:02

View deployment

SohamRatnaparkhi force-pushed the vorflux/pro-3222-3223-connector-permissions-docs branch from 1aa9eee to 9c49672 Compare October 27, 2026 14:07

docs(connectors): let writers set ACL enforcement (PRO-3222)

2ca1361

Signed-off-by: SohamRatnaparkhi <92905626+SohamRatnaparkhi@users.noreply.github.com> Co-authored-by: Soham Ratnaparkhi <soham@hydradb.com>

SohamRatnaparkhi force-pushed the vorflux/pro-3222-3223-connector-permissions-docs branch from 9c49672 to 2ca1361 Compare October 27, 2026 14:07

mintlify Bot deployed to staging October 27, 2026 14:07

View deployment

SohamRatnaparkhi previously approved these changes Oct 27, 2026

View reviewed changes

SohamRatnaparkhi dismissed their stale review via 61a0788 October 28, 2026 19:20

mintlify Bot deployed to staging October 28, 2026 19:21

View deployment

greptile-apps Bot reviewed Oct 28, 2026

View reviewed changes

Comment thread api-reference/v2/endpoint/update-connector.mdx

SohamRatnaparkhi approved these changes Oct 28, 2026

View reviewed changes

SohamRatnaparkhi merged commit ac2fd8a into main Oct 28, 2026
8 checks passed

SohamRatnaparkhi deleted the vorflux/pro-3222-3223-connector-permissions-docs branch October 28, 2026 19:26

Navigation Menu

Repository navigation

docs(connectors): document ACL enforcement (PRO-3222 PRO-3223) - #334

docs(connectors): document ACL enforcement (PRO-3222 PRO-3223)#334
SohamRatnaparkhi merged 8 commits into
mainfrom
vorflux/pro-3222-3223-connector-permissions-docs

vorflux Bot commented Oct 26, 2026 •

edited by SohamRatnaparkhi

Loading

Uh oh!

mintlify Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

greptile-apps Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

Uh oh!

openhack-agent Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

openhack-agent Bot left a comment

Uh oh!

vorflux Bot commented Oct 27, 2026

Uh oh!

vorflux Bot commented Oct 27, 2026

Uh oh!

SohamRatnaparkhi left a comment

Uh oh!

Uh oh!

SohamRatnaparkhi left a comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

vorflux Bot commented Oct 26, 2026 • edited by SohamRatnaparkhi Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Goal

Why

Links

Before and after

What changed

Tests

Where to look

Risks

Uh oh!

mintlify Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 26, 2026

✅ Mintlify Hygiene

Uh oh!

greptile-apps Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Findings

Summary

Uh oh!

Uh oh!

openhack-agent Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ OpenHack Summary

Confidence Score: 5/5

Uh oh!

openhack-agent Bot left a comment

Choose a reason for hiding this comment

Uh oh!

vorflux Bot commented Oct 27, 2026

Uh oh!

vorflux Bot commented Oct 27, 2026

Uh oh!

SohamRatnaparkhi left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

SohamRatnaparkhi left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vorflux Bot commented Oct 26, 2026 •

edited by SohamRatnaparkhi

Loading

mintlify Bot commented Oct 26, 2026 •

edited

Loading

greptile-apps Bot commented Oct 26, 2026 •

edited

Loading

openhack-agent Bot commented Oct 26, 2026 •

edited

Loading