Make the CEO the grant authority: implicit all-access, agent-tool grants, no manual assignment UI

tests/unit/connector-grants.test.ts

@@ -83,7 +83,8 @@ describe("connector grants", () => {
 
     const grants = new ConnectorGrantsService(h.connection.db);
     expect(grants.toolkitsForAgent(h.orgId, h.danaId)).toEqual(["github"]);
-    expect(grants.toolkitsForAgent(h.orgId, h.ceoId)).toEqual([]);
+    // The CEO holds every active connection by role, without a grant row.
+    expect(grants.toolkitsForAgent(h.orgId, h.ceoId)).toEqual(["github"]);
 
     const listing = dispatchAgentTool(h.deps, h.danaCtx, call("list_connectors", {}));
     expect(listing).toContain("GitHub (github): granted to Dana");

tests/unit/skill-grants.test.ts

@@ -0,0 +1,108 @@
+import { randomUUID } from "node:crypto";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, test } from "vitest";
+import { DatabaseConnection } from "../../src/main/database/connection";
+import { OrganizationService } from "../../src/main/services/organization-service";
+import { ChatService } from "../../src/main/services/chat-service";
+import { SkillService } from "../../src/main/services/skill-service";
+import { dispatchAgentTool, type AgentToolContext } from "../../src/main/services/agent-tools";
+
+function call(name: string, args: Record<string, unknown>) {
+  return { id: `call_${randomUUID()}`, name, arguments: args };
+}
+
+interface Harness {
+  connection: DatabaseConnection;
+  orgId: string;
+  ceoId: string;
+  danaId: string;
+  ceoCtx: AgentToolContext;
+  danaCtx: AgentToolContext;
+  deps: { db: DatabaseConnection["db"]; organization: OrganizationService; chat: ChatService };
+}
+
+function harness(): Harness {
+  const connection = new DatabaseConnection(join(tmpdir(), `ac-skill-${randomUUID()}.db`));
+  const organization = new OrganizationService(connection.db);
+  let orgId = "";
+  let ceoId = "";
+  let danaId = "";
+  connection.transaction(() => {
+    orgId = organization.createOrganization({ organizationName: "OrbitOps", employeeName: "Yang", mission: "m", goal: "g" });
+    const providerId = (connection.db.prepare("select id from providers where org_id = ? and provider_key = 'openai'").get(orgId) as { id: string }).id;
+    ceoId = organization.createAgent({
+      orgId, name: "CEO", role: "CEO", department: "Executive",
+      modelProviderId: providerId, modelId: "gpt-5.4", budgetCents: 25000, managerAgentId: null, roleLevel: "c_suite",
+    });
+    danaId = organization.createAgent({
+      orgId, name: "Dana", role: "Engineer", department: "Engineering",
+      modelProviderId: providerId, modelId: "gpt-5.4", budgetCents: 1000, managerAgentId: ceoId,
+    });
+  });
+  const context = (agentId: string): AgentToolContext => ({
+    orgId,
+    agent: { id: agentId, modelProviderId: null, modelId: null },
+    taskProjectId: null,
+    taskGoalId: null,
+    workspace: null,
+  });
+  return {
+    connection,
+    orgId,
+    ceoId,
+    danaId,
+    ceoCtx: context(ceoId),
+    danaCtx: context(danaId),
+    deps: { db: connection.db, organization, chat: new ChatService(connection.db) },
+  };
+}
+
+function importSkill(h: Harness, name: string, slug: string): void {
+  const now = new Date().toISOString();
+  h.connection.db.prepare(`
+    insert into skill_definitions(id, org_id, slug, name, owner_type, status, created_at)
+    values (?, ?, ?, ?, 'organization', 'active', ?)
+  `).run(`skl_${slug}`, h.orgId, slug, name, now);
+  h.connection.db.prepare(`
+    insert into skill_revisions(id, skill_id, version_semver, manifest_json, source_type, source_ref, published_at, immutable_checksum)
+    values (?, ?, '1.0.0', '{}', 'local_directory', '/tmp', ?, 'checksum')
+  `).run(`skr_${slug}`, `skl_${slug}`, now);
+}
+
+describe("skill grants", () => {
+  test("the CEO grants and revokes skills for teammates", () => {
+    const h = harness();
+    importSkill(h, "Release Gate", "release-gate");
+
+    const granted = dispatchAgentTool(h.deps, h.ceoCtx, call("grant_skill", { agent_name: "Dana", skill: "release-gate" }));
+    expect(granted).toContain("Dana now has the Release Gate skill");
+
+    const listing = dispatchAgentTool(h.deps, h.danaCtx, call("list_skills", {}));
+    expect(listing).toContain("Release Gate (release-gate): granted to Dana");
+
+    const skills = new SkillService(h.connection.db, "");
+    expect(skills.hasRuntimeSkills(h.orgId, h.danaId)).toBe(true);
+
+    const revoked = dispatchAgentTool(h.deps, h.ceoCtx, call("revoke_skill", { agent_name: "Dana", skill: "release-gate" }));
+    expect(revoked).toContain("no longer has the Release Gate skill");
+    expect(skills.hasRuntimeSkills(h.orgId, h.danaId)).toBe(false);
+  });
+
+  test("staff cannot hand out skills", () => {
+    const h = harness();
+    importSkill(h, "Release Gate", "release-gate");
+    const denied = dispatchAgentTool(h.deps, h.danaCtx, call("grant_skill", { agent_name: "Dana", skill: "release-gate" }));
+    expect(denied).toContain("ERROR");
+    expect(new SkillService(h.connection.db, "").hasRuntimeSkills(h.orgId, h.danaId)).toBe(false);
+  });
+
+  test("the CEO carries every active skill by role, without bindings", () => {
+    const h = harness();
+    const skills = new SkillService(h.connection.db, "");
+    expect(skills.hasRuntimeSkills(h.orgId, h.ceoId)).toBe(false);
+    importSkill(h, "Release Gate", "release-gate");
+    expect(skills.hasRuntimeSkills(h.orgId, h.ceoId)).toBe(true);
+    expect(skills.hasRuntimeSkills(h.orgId, h.danaId)).toBe(false);
+  });
+});