Delegated compartment administration

A client's own administrator can organise the vault's compartments —

creating them, naming them, putting people in them, and merging two into

one — without ever being able to read a document inside any of them.

That pairing is the whole design. Merging two compartments widens reach:

everyone who was in the source can afterwards see everything that was

already in the target. In an account that could also read documents,

that would not be an organising power at all — it would be a way to

reach any document in the vault by merging its compartment into your

own. So the vault gives this administrator no compartment of its own,

and refuses to give it one even when asked.

Putting a person into a compartment and taking them back out are the

same authority, deliberately. Widening someone's reach is the act that

needs guarding; narrowing it again is a correction, and an administrator

who could only ever add people would be one whose every mistake had to

be escalated to somebody else.

A client administrator organises compartmentsstack

Given a client administrator
When they create a compartment, rename it, and put a person in it
Then the vault records exactly those changes

A merge carries the people across, not just the documents

Given a client administrator
And two compartments, where the target already holds a document
And a person who belongs to the source compartment
When the source is merged into the target
Then the person can reach the document that was already in the target
And the source compartment no longer exists

A client administrator cannot be given a compartment

Given a client administrator
When they try to grant themselves a compartment
Then the vault refuses and they hold no compartment

A compartment cannot be merged into itself

Given a client administrator
And two compartments
When they try to merge a compartment into itself
Then the vault refuses and the compartment still exists

An assignment can be taken back by whoever made it

Given a client administrator
And two compartments
And a person who belongs to the source compartment
When they take that person back out of the compartment
Then the person no longer belongs to it

Taking someone out of a compartment needs the same authority as putting them in

Given a client administrator
And two compartments
And a person who belongs to the source compartment
When an ordinary person tries to take them out
Then the vault refuses and the person still belongs to the compartment

A name already in use is refused, and nothing is renamed

Given a client administrator
And two compartments
When they try to rename one to the other's name
Then the vault refuses and the compartment keeps its name

Someone with no administrative authority can change nothing

Given an ordinary person
When they try to create, rename, merge, and assign compartments
Then every attempt is refused and the compartments are untouched