Authorization Types

Source of truth: src/assync/core/enums.py::AuthorizationType and AUTHORIZATION_CAPABILITY_GRANTS. See Authorization Model for how these are actually enforced (intersection with role capabilities, never a union).

Type	Capabilities granted
ANALYSIS_GO	repository_read, runtime_read, analysis_execute, report_write, finding_create
IMPLEMENTATION_GO	repository_read, repository_write, runtime_read, runtime_write, test_execute, analysis_execute, report_write, finding_create
REVIEW_GO	repository_read, runtime_read, analysis_execute, report_write, finding_create
SECURITY_GO	repository_read, runtime_read, analysis_execute, report_write, finding_create
QA_GO	repository_read, runtime_read, test_execute, report_write, finding_create
DECISION_GO	repository_read, runtime_read, decision_recommend
COMMIT_GO	repository_read, runtime_read, commit_prepare, commit_execute
PUSH_GO	repository_read, runtime_read, push_prepare, push_execute
MERGE_GO	repository_read, runtime_read, merge_prepare, merge_execute
RELEASE_GO	repository_read, runtime_read, release_prepare, release_execute
ABORT	(none)

This table is the single source of truth for authorization-rule enforcement (authorization/policy.py). Nothing outside it is ever granted; absent authorization means deny. Each type's grant is disjoint by design — COMMIT_GO never implies PUSH_GO, PUSH_GO never implies MERGE_GO, MERGE_GO never implies RELEASE_GO.

ABORT exists so an active authorization can be explicitly revoked without deleting its record — it grants nothing.

Escalation

No code path in this MVP mints a new, more powerful Authorization on its own. The only place that can is decisions/service.py::resolve_decision(..., grant_authorization_type=...), and only when the decision resolves to APPROVED by a named human actor. See Decision Queue.