Surfaces shaped by what an account can reach

The vault has always held that an administrator belongs to no compartment

and can therefore read no document, and the delegated compartment

administrator — the clientadmin — is built the same way on purpose, because

an account able to merge compartments and also read them could quietly

merge its way into anything. So the vault does not offer either of them

what it would refuse: the page says plainly why there is no upload form

and no query box, the API refuses the same request for the same reason,

and the refusal is recorded. The reason

names only the caller's own account, which the vault will tell them anyway

if they ask, and never anything about what the vault holds. For an ordinary

member nothing changes at all — the same form, the same pipeline, the same

gates, the same refusals.

The vault refuses before the ingest pipeline is ever reached

Given a portal whose caller holds no compartment
When that caller uploads a document
Then the vault refuses and the ingest pipeline never runs

The refusal names the caller's own account and nothing else

Given a portal whose caller holds no compartment
When that caller uploads a document
Then the refusal names their kind of account
And the refusal mentions no document, compartment, or count

An ordinary member's upload is untouched by any of this

Given a portal whose caller belongs to a compartment
When that caller uploads a document
Then the ingest pipeline runs exactly as it always did

An administrator is told why the upload form is not therestack

Given a running vault with an administrator and a clientadmin signed in
When the administrator sends a document to the upload API
Then the vault refuses and names their own kind of account
And the refusal is in the audit trail

A delegated compartment administrator is refused a querystack

Given a running vault with an administrator and a clientadmin signed in
When the clientadmin sends a search to the query API
Then the vault refuses and names their own kind of account
And the refusal is in the audit trail

The portal page carries the wording that stands where a form wouldstack

Given a running vault with an administrator and a clientadmin signed in
When a visitor fetches the portal page
Then the page carries a stated reason for both the upload and the query surface