0049. AI on its own reads a team's data through the team's delegation, and only advises

Status: accepted, 2026-10-30. Extends 0026 (delegations) with kinds for a team and the instance.

Context

Diagnoses of failed builds, deploys, crashes and alerts, review notes on deploys and post-mortem drafts run with nobody at the keyboard. They need to read a team's logs, errors, metrics and changes. ADR 0026's delegations are a person's, and a person's delegation would stop working when that person leaves the team; ai's own service credentials, listed on every read operation, would let a compromised ai read every team's data whether the team wanted the feature or not. And a model that reads text outsiders wrote, then acts, is the attack: a confident wrong answer is already bad enough.

Decision

A team delegation. Background AI work reads a team's data through a delegation of the team, held by ai: read scope only, the services the team chose, at most a year, created by one of the team's admins or owners with a passkey, revocable by any of them in id or in ai. id exchanges it for five-minute tokens of the team (a viewer, read scope), shaped like the team tokens id already issues, so every service applies its ordinary checks. The instance's own platform (alerts of no team) has an instance delegation a superuser creates the same way: read-only superuser tokens.
It never changes anything. Background runs have no tools and no write scope, and the approvals gate refuses their tokens at every risk above none, a floor in code, so they can't even ask a person. What they suggest is offered to people: the triggering event's own actions, links, and the assistant, which acts only through approvals (0047).
Rules before models. Deterministic matchers and checks run first and say so; a model writes the explanation when they don't settle it, in a fixed shape whose evidence and actions are references to lists the server built. The method and the confidence are always shown, and "unknown" is an answer.
It annotates what people already get. A diagnosis is attached to notify's event or alert and edited into the messages already sent, not sent as a new notification; a review is a note beside a deploy; a post-mortem is a draft page in a docs space that accepts drafts from ai.

Consequences

A team's data reaches the AI only after its admin's passkey; ending the delegation stops the features, and an attention item warns 14 days before it ends.
id's delegations gain the kinds team and instance; notify becomes the second producer of watches (0021) so ai follows failures without polling; docs takes drafts from ai only into spaces that opted in.
A compromised ai reads only teams that granted it, and changes nothing through background work. The instance delegation is the broad grant: its tokens read what a read-only superuser reads, and only ai's own code keeps it to instance-owned objects, so it exists only once a superuser creates it.
notify's watches are ADR 0021's second producer, so that machinery moves into kit, as ADR 0021 foresaw.
Design: superpowers/specs/2026-10-30-assistant-design.md in this repository.