- Edit Policy record action on groups and policies (feature POLICIES,
permission authentik.policies.manage): streamed-ETL with the
AUTHENTIK_POLICY_EDITOR widget on its step; Review parses fail-closed,
regenerates canonically with the round-trip check, refuses new resources the
app does not define, applies the subset rule to added permissions and lists
the changes; Result merge-patches qqq.io/policy into the group's current
attributes (removed when empty). Optional policyTwoPersonApproval.
- PolicyCatalog: apps, tables, processes (hidden record actions included),
reports and protected widgets with the actions QQQ checks, grouped by app;
joins the permission catalog.
- authentik_policy local table (one row per group, field-level audit as the
change history), nav and child list on the group; DDL in docs/schema.sql.
- Widget authentikPolicyEditor: catalog plus the live document, flagged when
changed in Authentik since the last QQQ save.
- Tests: catalog, admin rules, process, widget, gating, approval, and a
savePolicy contract test on Authentik 2026.8.3.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
james.maesandClaude Opus 5.5