Found while implementing #142 (mirroring the ratified 17.1.0 notes into resources/changelog.mdx). Not fixed there — #142's file surface is content/docs/resources/changelog.mdx and nothing else.
The claim
content/docs/configure/permissions/permission-sets.mdx, under "Export is its own grant":
71: Three consequences worth planning for:
72:
73: - **Package-shipped sets are re-seeded on upgrade**, so
74: `admin_full_access` and `organization_admin` carry `allowExport: true`
75: for you. **Environment-authored sets are not** — edit any custom set
76: whose users export.
That is a claim about now, not about when a behaviour changed — the reader is told they need do nothing for the two shipped admin sets. It was true on 17.0.0. It is false on 17.1.0, the current series.
What upstream ratified
objectstack origin/main, content/docs/releases/v17.mdx, "Security corrections in 17.1.0" (#8681):
The shipped admin permission sets no longer grant export on the * wildcard (#8681). … admin_full_access, organization_admin and the derived organization_admin_no_bypass carried objects['*'].allowExport = true, which made the 17.0 export axis undeniable: an application could declare an object exportable by nobody and the platform exported it anyway. … READ is untouched — this narrows bulk egress only, and allowExport on a '*' entry remains a supported authoring shape in an app's own sets.
And the 17.1.0 upgrade checklist on the same page:
Grant allowExport explicitly wherever admin export is intended (#8681). The platform admin sets no longer carry the '*' export wildcard, and nothing fails at parse time — a deployment that upgrades without editing anything is valid metadata whose administrators have quietly lost export on every object no app set names. There is deliberately no automatic replacement.
Why this one matters more than an ordinary staleness
The failure is silent on both ends. Nothing fails at parse time on upgrade, and this page is the one that tells an operator they do not have to act. A reader who follows it ships an upgrade in which platform administrators have lost export on every object no app permission set names, and the page they consulted is the reason they did not look.
Scope of the fix
The whole live claim is the third sentence of that bullet, plus whatever the fix needs to say instead. Note the surrounding lines are historical and must not be swept along:
permission-sets.mdx:60 — "Unset used to mean 'inherit read'. Since ObjectStack 17.0 it means denied …" — a fact about when a behaviour changed. Stays.- The
member_default bullet and the high-privilege/audience-anchor bullet are unaffected by #8681.
Whoever takes this should also decide whether the replacement text belongs here alone or whether configure/permissions/managing-access.mdx repeats it — I did not sweep beyond the one page.
Back-link: #142.
Found while implementing #142 (mirroring the ratified 17.1.0 notes into
resources/changelog.mdx). Not fixed there — #142's file surface iscontent/docs/resources/changelog.mdxand nothing else.The claim
content/docs/configure/permissions/permission-sets.mdx, under "Export is its own grant":That is a claim about now, not about when a behaviour changed — the reader is told they need do nothing for the two shipped admin sets. It was true on 17.0.0. It is false on 17.1.0, the current series.
What upstream ratified
objectstackorigin/main,content/docs/releases/v17.mdx, "Security corrections in 17.1.0" (#8681):And the 17.1.0 upgrade checklist on the same page:
Why this one matters more than an ordinary staleness
The failure is silent on both ends. Nothing fails at parse time on upgrade, and this page is the one that tells an operator they do not have to act. A reader who follows it ships an upgrade in which platform administrators have lost export on every object no app permission set names, and the page they consulted is the reason they did not look.
Scope of the fix
The whole live claim is the third sentence of that bullet, plus whatever the fix needs to say instead. Note the surrounding lines are historical and must not be swept along:
permission-sets.mdx:60— "Unset used to mean 'inherit read'. Since ObjectStack 17.0 it means denied …" — a fact about when a behaviour changed. Stays.member_defaultbullet and the high-privilege/audience-anchor bullet are unaffected by #8681.Whoever takes this should also decide whether the replacement text belongs here alone or whether
configure/permissions/managing-access.mdxrepeats it — I did not sweep beyond the one page.Back-link: #142.