Requirement for Release 2.
The problem
A product that needs another product's account and the identity context that follows from
it cannot be granted them. Trust between products is declared in the product manifest, and
nothing in the core or the generated client reads that declaration, so it decides nothing.
Cross-product access is never granted — only prompted, or refused — which puts the cost on
the user rather than on the publisher who meant to allow it.
The core also answers the same cross-product request differently depending on which call
carries it. Some raise a review and remember the answer. One raises a different review, on
a grant that by construction never applies across products. The rest refuse outright, with
no way to approve. Every one of those paths is in the shared core that all hosts embed, so
a product asking for one partner account gets consent asked, consent asked differently, or
a flat refusal, according to the method it happens to call.
What has to be true for Release 2
Explicitly out of scope
- Reading another product's state. That is REQ1.
- Outbound access — reaching domains, and submitting chain transactions, preimages and
statements. That is REQ6.
- Removing prompts that exist for the user's own sake: identity disclosure, device
permissions, and the confirmation raised when a product's own account has to be resolved
cold. This requirement covers what a declared partner may use; it makes nothing
promptless that prompts today to protect the user.
Requirement for Release 2.
The problem
A product that needs another product's account and the identity context that follows from
it cannot be granted them. Trust between products is declared in the product manifest, and
nothing in the core or the generated client reads that declaration, so it decides nothing.
Cross-product access is never granted — only prompted, or refused — which puts the cost on
the user rather than on the publisher who meant to allow it.
The core also answers the same cross-product request differently depending on which call
carries it. Some raise a review and remember the answer. One raises a different review, on
a grant that by construction never applies across products. The rest refuse outright, with
no way to approve. Every one of those paths is in the shared core that all hosts embed, so
a product asking for one partner account gets consent asked, consent asked differently, or
a flat refusal, according to the method it happens to call.
What has to be true for Release 2
productAccountId, and the identity context thatfollows from it, without the user being prompted
prompted, never silently allowed
access
Explicitly out of scope
statements. That is REQ6.
permissions, and the confirmation raised when a product's own account has to be resolved
cold. This requirement covers what a declared partner may use; it makes nothing
promptless that prompts today to protect the user.