[FEATURE]: Owners vs Projects/Teams — audit and document visibility rules across all scenarios

[larsgeorge-db]

Reported by external stakeholder (codename: dtag) — 2026-05-20
Status: Investigation + documentation task

Is there an existing issue for this?

• I have searched the existing issues

Problem statement

It is currently unclear, both to end users and to maintainers, what becomes visible to whom as a function of ownership versus Project/Team membership. Examples of unanswered questions:

• If a Data Product has an Owner (user) but no Project/Team assignment, who can see it?
• If a Data Product is assigned to a Project, does the Project's Team grant transitive visibility?
• How does the Owner cascade interact with Project membership for non-admin users?
• How does an Admin role (Ontos role vs. workspace admins group) override these rules?
• What is the visibility behaviour when a user belongs to multiple Teams that scope the same entity differently?

There is no end-to-end scenario matrix today, and we have observed at least two regressions in this area in the past quarter (see #395 / #399), suggesting the ruleset is not well characterised.

Proposed Solution

Produce an authoritative scenario matrix and accompanying user-facing docs:

1. Enumerate every feature where Owner / Project / Team scoping applies (Data Products, Data Contracts, Glossaries, Asset Reviews, Workflows, …).
2. Define a test matrix: {role} × {entity type} × {ownership state} × {project/team membership}.
3. Execute the matrix against a representative test workspace.
4. Capture the results as a docs page (e.g. docs/visibility-rules.md) with one canonical table per entity type.
5. File follow-up bugs / enhancements for any deviations the matrix surfaces.

Additional Context

Related historical work:

• feat(data-products): ownership-cascade scoping + clone-product schema-drift repair #395 — data-product ownership-cascade scoping
• fix(data-products): admin cascade-bypass uses Ontos role, not just workspace group #399 — admin cascade-bypass via auth manager