mikebridge opened a new pull request, #44033: URL: https://github.com/apache/superset/pull/44033
### SUMMARY Documents in `SECURITY.md` that an entity's **version history** — its change-record activity stream, field-level before/after diffs, and the author identity and timestamps attached to each change — is **not part of the base *Read data* capability** and requires **object-level editorship** (owner, editor, or Admin), the same capability required to restore a version. An embedded guest token and any view-only (read-but-not-edit) role is explicitly **not** entitled to version history, change metadata, or author identity. Related-entity records in a cross-entity activity view remain silently filtered to the reader's own read access (AV-008, unchanged). ### Motivation The role/capability matrix was silent on whether version-history / change metadata is inside guest and view-only entitlement, so reviewers repeatedly re-derived it. The same class surfaced three times: the versioning-UI capstone review's M10 (2026-07-31, guest tokens reading full edit history + editor identities, "the matrix doesn't answer this"), the approval-workflow review, and a QA finding where view-only roles could read full history via the API. This adds the missing row so the boundary is written down once. It documents the model that the server-side enforcement (edit-gating the version/activity endpoints) implements. ### BEFORE/AFTER N/A — documentation only (adds one subsection to `SECURITY.md`). ### TESTING INSTRUCTIONS N/A — no code change. ### ADDITIONAL INFORMATION - [ ] Has associated issue - [x] Required feature flags: N/A - [x] Changes UI: no - [x] Includes DB Migration: no - [x] Introduces new feature or API: no - [x] Removes existing feature or API: no -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
