Surfaced while investigating #379 (2026-07-24).
vendor-visibility-rbac REQ-006 fixed the contract schema by removing the public grant and match-scoping aanbod-beheerder to _organisation. But the same schema's authorization.read still lists several bare, unscoped role strings: gebruik-beheerder, ambtenaar, functioneel-beheerder, organisatie-beheerder, organisaties-beheerder, gebruik-raadpleger, vng-raadpleger, software-catalog-admins/users.
Same fix shape as #379: replace bare strings with {"group": "<role>", "match": {"_organisation": "$organisation"}} where the role is org-scoped by intent.
Note the operator constraint found in #379's investigation: OpenRegister's ConditionMatcher/OperatorEvaluator supports only $eq/$ne/$in/$nin/$exists/$gt/$gte/$lt/$lte — there is no array-contains operator, so a deelnemers-array leg cannot be expressed at the schema-RBAC layer today. Either document that as an accepted residual (deelnemer sharing stays app-controller-enforced) or add a $contains operator to OpenRegister first.
Related: #379, #378, PR #377.
Surfaced while investigating #379 (2026-07-24).
vendor-visibility-rbac REQ-006 fixed the
contractschema by removing thepublicgrant and match-scopingaanbod-beheerderto_organisation. But the same schema'sauthorization.readstill lists several bare, unscoped role strings:gebruik-beheerder,ambtenaar,functioneel-beheerder,organisatie-beheerder,organisaties-beheerder,gebruik-raadpleger,vng-raadpleger,software-catalog-admins/users.Same fix shape as #379: replace bare strings with
{"group": "<role>", "match": {"_organisation": "$organisation"}}where the role is org-scoped by intent.Note the operator constraint found in #379's investigation: OpenRegister's ConditionMatcher/OperatorEvaluator supports only
$eq/$ne/$in/$nin/$exists/$gt/$gte/$lt/$lte— there is no array-contains operator, so adeelnemers-array leg cannot be expressed at the schema-RBAC layer today. Either document that as an accepted residual (deelnemer sharing stays app-controller-enforced) or add a$containsoperator to OpenRegister first.Related: #379, #378, PR #377.