Repository navigation
Convert policy authZ from being based on a user to a user on a visit #1616
Description
Activity
- changed the title
[-]Convert policy authorization from being based on a user to a user on a visit[/-][+]Convert policy authZ from being based on a user to a user on a visit[/+]on Aug 7, 2026 Just to add reasoning for posterity:
For most in-person visits experiments are performed by a team of a few users on site. The team are likely to run in some kind of shift pattern e.g. one person will look after the experiment whilst another goes to sleep/dinner. For long running experiments you can get into the situation where someone runs something, goes off to dinner and the person left realises that actually the running experiment is incorrect and wants to stop it.
Reacted by Zoheb ShaikhFor i15-1 we're using the fact that a session is not 100% required to allow for the stop all case even if the user is logged in without a session. It shouldn't really be possible for a user to be able to log in without a session but we don't want to bet the safety of a detector on it. This means it would be good to have some solution for #1681 (or at least a discussion) before this is implemented
These are the current policies
Admin
Users:
the policy change that @DominicOram and @EmsArnold suggested is
the policy for admin remains the same but for the users it will change as follows.
Users:
Acceptance Criteria