[Makisuo]

Sixth layer of the Observer role, on top of #2550. The API already refuses an observer every change; this layer stops the dashboard from offering the ones that would only fail, on Dashboards, Errors, incidents and status pages.

What changed

• Policy table. It now names the changes a member can make and an observer cannot: dashboards:edit, dashboards:share, error_issues:triage, incidents:respond, investigations:run, status_page_incidents:post, recommendations:triage. The API enforces them in one place (the read-only gate), so these exist for pages to read.
• Dashboards list. Without dashboards:edit: no Import or Create, no Duplicate, Edit tags or Delete in a row's menu, no "New dashboard" row. Browse templates and Export JSON stay.
• A dashboard. No Edit toggle, so none of what hangs off edit mode (add, move, resize, clone or delete a widget, groups, variables, tags, rename), and no "Restore this version". Opening a board with ?mode=edit shows the read view. Without dashboards:share: no "Share…" and no "Embed chart".
• Templates gallery. Browsing and previewing stay; the create row does not.
• Reading is whole. Time range, refresh, variable values, tabs, version history and its preview, favorites and JSON export are untouched.
• Errors list. Without error_issues:triage: no row selection or bulk bar, the status and severity pickers are plain readouts, the right-click menu has no status or claim entries, and the x, s and p shortcuts do nothing.
• An error issue. Status and severity are readouts; no Claim, Extend or Release, no Unmerge, no pull request Attach or Detach, no comment box. The timeline, comments, occurrences and linked pull requests stay.
• Get it fixed. Needs investigations:run. Without it, an observer sees an investigation that already ran but is offered neither a new one nor the agent prompt.
• Incidents. Without incidents:respond: no Acknowledge on an alert incident or an inbox row; no Resolve, Link issue or Unlink on an anomaly. Controls that already need alerts:manage are unchanged.
• Status pages. Without status_page_incidents:post: no Post incident, Post update, Resolve, Edit details or Delete. Controls that already need status_pages:edit are unchanged.
• Investigations. Without investigations:run: no investigate bar on the list, and no Investigate on an incident or anomaly. A finished investigation still opens.
• Lab. /lab/alerts, /lab/anomaly-alerts and /lab/status-pages take ?role=admin|member|observer. /lab/dashboards?page=list|detail&role=member|observer, /lab/errors?role= and /lab/error-issue?role= render the pages for either viewer.

Members, engineers and admins see what they saw before. In Clerk mode a page learns the viewer's grants a moment after it opens, so their write controls appear with that answer, as on the alerts pages.

Screenshots

	Member	Observer
List
Board
Board menu

Errors:

	Member	Observer
Issue
Activity
List

Incidents and status pages:

	Member	Observer
Alert incident
Inbox
Status page incident

Verified

• apps/web: the dashboards, errors, lab and shell tests pass (540 in the dashboards run; 1,444 across alerts, anomalies, investigations, status pages, errors and the lab). New scene tests pair an observer with a member on each page.
• packages/domain: policy tests, 16 passed.
• @maple/web typecheck, the CI lint config on every changed file, the UI class pattern check and the UI kit baseline (unchanged).
• The lab pages driven in a headless browser for the screenshots.

Known gaps

• The widget editor page is unchanged: an observer who opens its URL directly gets the editor, and saving answers with the API's 403. No control leads them there.
• "Create alert" in a widget's menu still shows; the alerts create page it opens already needs alerts:manage.
• The errors list's bulk bar has no screenshot: the lab never draws it. A scene test on the real page covers it for both viewers.
• The investigation detail page still offers Resolve, Run again and Reopen to an observer; the API refuses them. It has no grants in its Model yet.
• "New rule" and an incident's "Edit rule" link are shown to members and observers alike, though saving a rule needs alerts:manage. That predates this work.
• The anomaly detail page and the investigations list have no lab entry, so they are covered by scene tests only.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 82e752d1-d2bd-4ec7-a72a-7271839daa34

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[maple-review-bot]

Maple review

🟢 Confidence 10/10 · safe to merge. Every page dispatches its grants read at init and gates both modes; each surface has member and observer scene tests.
_{1 note · tests covered · risk medium}

Gates the dashboards, errors, incident, anomaly, status page and investigation views on the new member-level permissions, so an observer gets read-only pages, and adds a ?role= toggle to the labs. The grants plumbing and the reader paths hold up; safe to merge.

• Seven member-level permissions added to the policy table, read by pages only.
• Each page reads grants once at init through fetchSessionGrants and acceptGrants.
• isEditing now needs dashboards:edit, so ?mode=edit reads for an observer.
• Errors hub drops selection, pickers and the x/s/p keys without error_issues:triage.

Still open from earlier reviews

• 🔵 Note · F1 · Dashboard labs never feed grants, so they render read-only in Clerk builds · apps/web/src/page/dashboards/view/mode.ts:14

_{f052e30 · What was checked, coverage and telemetry details are on the Maple / review check. Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}