@@ -0,0 +1,18 @@
+---
+'@objectstack/plugin-security': patch
+'@objectstack/plugin-auth': patch
+---
+
+fix(plugin-security, plugin-auth)!: a person-to-permission-set assignment refuses an agent ceiling set at every write door, and so does the self-registration permission set
+
+Clause-②: no (narrowing) — a non-system insert or update of `sys_user_permission_set` that would store an assignment naming one of the three MCP agent ceiling sets (`mcp_agent_data_read`, `mcp_agent_data_write`, `mcp_agent_restricted`) is refused with `400 VALIDATION_FAILED` (`invalid_value` at `permission_set`), for every caller, a platform administrator included; and an audience configuration whose `selfRegistrationPermissionSet` names one is refused (`[audience] invalid audience configuration`), at construction and through the auth settings; nothing is widened.
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) no key of any schema is added, removed or re-shaped: a runtime write of an assignment row naming an agent ceiling set is refused and a stored one is left for an administrator to remove, and the runtime audience validation refuses one as the self-registration set, which takes a person's set chosen by hand, not a mechanical conversion -->
+
+**BREAKING** for a deployment whose administrators assign an MCP agent ceiling set to users through the permission-set assignment table, or whose audience names one as `selfRegistrationPermissionSet`.
+
+- **The rule (ADR-0090 D10).** The agent ceiling sets are an AI agent's own grants. The door that admits an agent connected over MCP derives its ceiling from the scopes its user consented to and puts it on the agent's request; no assignment row is read for it. A `sys_user_permission_set` row is a person's grant, so it never names one. Every door that writes the table refuses such a row: the data API's create and update, `createMany`, `updateMany`, the per-object and cross-object batch, and both import doors (the row fails with `code: 'invalid_value'` at `permission_set`). An update that keeps an assignment naming one in force (a new holder, a validity window, an echo of the set) is refused too.
+- **The self-registration set (`@objectstack/plugin-auth`).** A self-registrant is a person, so the audience configuration that names the set every self-registrant receives refuses an agent ceiling set, beside its existing refusal of `admin_full_access`: `auth.audience.selfRegistrationPermissionSet` in the stack config stops the boot, and `audience_self_registration_permission_set` in the auth settings is refused while the standing audience keeps ruling. Both answer `[audience] invalid audience configuration: selfRegistrationPermissionSet must not be '...'`.
+- **Unchanged.** Every other permission set stays assignable, and removing an assignment stays open. A system write is not judged: the platform's fixed-name grant writers name no ceiling, the self-registration grant writes only the validated set, and seed replay and the development-only demo-staff seed write the sets their stack declares. An agent connected over MCP holds its ceiling exactly as before. An organization administrator is still refused the same sets on the organization boundary first (`403 PERMISSION_DENIED`).
+- **Who moves, and the fix.** An assignment stored before this release that names an agent ceiling set is left as it is, and can no longer be edited: delete it (`DELETE /api/v1/data/sys_user_permission_set/ID`), or rename it to a permission set meant for people. List them with `GET /api/v1/data/sys_user_permission_set?permission_set=mcp_agent_data_read` and the same query for the other two names. An audience that names an agent ceiling set as `selfRegistrationPermissionSet` declares a permission set meant for people instead (`member_default`, or the deployment's own).
@@ -139,6 +139,7 @@ bugs — it is the protection or the side effect that silently does not happen.
 | 23c | **Grant-name catalog check skipped** — a `sys_user_permission_set` write whose `permission_set` names no permission set in the security catalog is not refused | plugin-security | Get: a system writer can store a grant naming a set not yet registered — seed replay and boot provisioning may write the grant before the definition it names is registered. Lose: such a row grants nothing and nothing says so. A non-system insert, or a non-system update that changes `permission_set`, is refused `400 VALIDATION_FAILED` / `reference_not_found` instead when the security catalog holds no set by that name; a grant that names no set at all is refused `required` for every caller. The grant names its set by name alone, and nothing derives the name from `permission_set_id` (ADR-0131 D4, D10) | `packages/plugins/plugin-security/src/grant-permission-set-name.ts#onInsert`, `packages/plugins/plugin-security/src/grant-permission-set-name.ts#onUpdate` |
 | 23d | **Grant-holder membership check skipped** — a `sys_user_position` or `sys_user_permission_set` write naming a user with no `sys_member` row in the row's organization is not refused | plugin-security | Get: a system writer can store such a grant — invitation acceptance writes the membership and its placement together, and seed replay, the organization-admin reconcile and the platform bootstraps write grants as the system. Lose: such a row takes effect once its user is admitted to the organization. A non-system insert, or a non-system update that moves `user_id` or `organization_id`, is refused `400 VALIDATION_FAILED` / `reference_not_found` at `user_id` instead, for every caller, a platform administrator included; the membership is read as `{ isSystem: true, tenantId }` with `tenantId` the row's own organization, never another one. A row stored with no organization is not judged. Under `single`, 18.0 stamps a new grant with the Default Organization, so such a row is one an earlier release wrote | `packages/plugins/plugin-security/src/grant-holder-membership-refusal.ts#onInsert`, `packages/plugins/plugin-security/src/grant-holder-membership-refusal.ts#onUpdate` |
 | 23e | **A `secret` field takes a stored reference as given** — a value already spelled `secret:` is stored unchanged | objectql | Get: a system writer may copy a `secret:` reference onto a record as it stands (seed replay, a migration). Every other caller may only seal a new value or keep its own record's ref: on a create any such value is refused, and on an update it is accepted only when every record the write lands on already holds exactly that reference in that column, which is then left as it is, as an echoed read mask is. Any other reference is refused `400 VALIDATION_ERROR` before anything is written, with one answer whatever it names. Lose: the check that the reference is the record's own — a system writer that copies one is trusted to mean it. Inbound HTTP never carries the flag | `encryptSecretFields` |
+| 23f | **Agent ceiling grant check skipped** — a `sys_user_permission_set` write naming an MCP agent ceiling set is not refused | plugin-security | Get: a system writer is not judged. The platform-admin promotion and the organization-admin reconcile name their sets in code, and neither is a ceiling; the self-registration grant writes the configured `audience.selfRegistrationPermissionSet`, which the audience validation (`assertAudienceConfig`, plugin-auth) refuses when it names an agent ceiling set. Lose: seed replay and the development-only demo-staff seed write the sets their stack declares, unjudged, so a seed that names an agent ceiling set stores it. A non-system insert, or a non-system update whose resulting row names one, is refused `400 VALIDATION_FAILED` / `invalid_value` at `permission_set`, for every caller, a platform administrator included; a delete is not judged (ADR-0090 D10) | `packages/plugins/plugin-security/src/agent-ceiling-grant-refusal.ts#onInsert`, `packages/plugins/plugin-security/src/agent-ceiling-grant-refusal.ts#onUpdate` |
 | 24 | Tenant-audit warning silenced; `bypassTenantAudit` threaded to the driver | objectql | Get: unscoped system writes stop warning. Lose: the signal that would flag a genuine user-path scoping bug | `buildDriverOptions` |
 | 25 | Engine-owned / append-only write guard bypassed | plugin-security | Get: generic writes to `managedBy` engine-owned objects | `packages/plugins/plugin-security/src/system-write-guard.ts#isUserContextWrite`, `packages/plugins/plugin-security/src/system-write-guard.ts#assertEngineOwnedWriteAllowed` |
 | 26 | Identity write guard bypassed (ADR-0092) | plugin-auth | Get: direct writes to identity tables through the generic data path | `packages/plugins/plugin-auth/src/identity-write-guard.ts#isUserContextWrite` |
@@ -578,6 +579,8 @@ and CI refuses one that differs from what the tree produces.
 | `packages/plugins/plugin-auth/src/owner-fixed-rule.ts#isOwnerChange` | 1 | 26c |
 | `packages/plugins/plugin-auth/src/principal-session-mint.ts#refuseUpFront` | 1 | 61b |
 | `packages/plugins/plugin-email/src/email-template-door.ts#isOrganizationWrite` | 1 | 59 |
+| `packages/plugins/plugin-security/src/agent-ceiling-grant-refusal.ts#onInsert` | 1 | 23f |
+| `packages/plugins/plugin-security/src/agent-ceiling-grant-refusal.ts#onUpdate` | 1 | 23f |
 | `packages/plugins/plugin-security/src/flow-system-identity-write-refusal.ts#elevationSource` | 1 | 1b |
 | `packages/plugins/plugin-security/src/grant-holder-membership-refusal.ts#onInsert` | 1 | 23d |
 | `packages/plugins/plugin-security/src/grant-holder-membership-refusal.ts#onUpdate` | 1 | 23d |
 
@@ -36,6 +36,7 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 import type { PluginContext } from '@objectstack/core';
 import { AUDIENCE_POSTURES } from '@objectstack/spec/system';
+import { MCP_AGENT_PERMISSION_SET_WRITE } from '@objectstack/spec/ai';
 import { AuthPlugin } from './auth-plugin.js';
 import { AuthManager } from './auth-manager.js';
 import { OPEN_POSTURE_VERIFICATION_OFF_WARNING } from './audience-posture.js';
@@ -232,6 +233,19 @@ describe('auth.audience_* — the settings switch surface (#11768)', () => {
     expect(errorLines().some((m: string) => m.includes('admin_full_access'))).toBe(true);
   });
 
+  it('an agent ceiling set as the self-registration permission set is refused through the settings channel', async () => {
+    const { manager } = await boot({
+      settings: {
+        audience_posture: { value: 'open', source: 'global' },
+        audience_self_registration_permission_set: { value: MCP_AGENT_PERMISSION_SET_WRITE, source: 'global' },
+      },
+    });
+    expect(manager.getAudience().posture).toBe('invite_only'); // standing default keeps ruling
+    const logged = errorLines();
+    expect(logged.some((m: string) => m.includes('audience settings REFUSED'))).toBe(true);
+    expect(logged.some((m: string) => m.includes(`selfRegistrationPermissionSet must not be '${MCP_AGENT_PERMISSION_SET_WRITE}'`))).toBe(true);
+  });
+
   it('open with verification OFF stored only through the CONSOLE is refused — the console cannot make the opt-out', async () => {
     // The audience patch is applied AFTER the main patch, so the merged-result
     // validation judges it against the `require_email_verification: false`
 
@@ -22,6 +22,7 @@
 import { describe, it, expect, vi } from 'vitest';
 import { assertEngineDeleteDispatch, assertEngineUpdateDispatch, assertEngineFindOnePredicate } from '@objectstack/objectql';
 import { ERROR_CODE_LEDGER } from '@objectstack/spec/api';
+import { MCP_AGENT_PERMISSION_SETS } from '@objectstack/spec/ai';
 import { AuthManager } from './auth-manager';
 import { bindTestSecurityCatalog, catalogFromTables } from './__tests__/security-catalog.testkit.js';
 import {
@@ -452,6 +453,24 @@ describe('entry validation: assertAudienceConfig (#11739)', () => {
     ).toThrow(/admin_full_access/);
   });
 
+  it.each(MCP_AGENT_PERMISSION_SETS)('refuses the agent ceiling set %s as the self-registration permission set, under each self-registration posture', (name) => {
+    const domains = { allowedEmailDomains: ['acme.com'] };
+    for (const audience of [{ posture: 'open' as const }, { posture: 'email_domain' as const, ...domains }]) {
+      expect(
+        () => assertAudienceConfig({ ...audience, selfRegistrationPermissionSet: name }, undefined),
+        audience.posture,
+      ).toThrow(
+        new RegExp(`^\\[audience\\] invalid audience configuration: selfRegistrationPermissionSet must not be '${name}' — it is the permission ceiling of an AI assistant connected over MCP`),
+      );
+    }
+  });
+
+  it('control: a permission set meant for people stays a declarable self-registration set', () => {
+    for (const set of ['member_default', 'portal_user']) {
+      expect(() => assertAudienceConfig({ posture: 'open', selfRegistrationPermissionSet: set }, undefined), set).not.toThrow();
+    }
+  });
+
   it('email_domain: an explicit verification-off stays refused, from ANY declarant (the domain list is the only gate there)', () => {
     const emailDomain = {
       posture: 'email_domain' as const,
 
@@ -90,6 +90,7 @@
  */
 
 import { isCloudManaged } from '@objectstack/core';
+import { MCP_AGENT_PERMISSION_SETS } from '@objectstack/spec/ai';
 import {
   AUDIENCE_POSTURES,
   SystemUserId,
@@ -217,8 +218,11 @@ export const OPEN_POSTURE_VERIFICATION_OFF_WARNING =
  * Entry validation — REFUSES an unusable audience declaration at the point it
  * enters the manager (constructor and `applyConfigPatch`), loudly, with the
  * remedy in the message. Mirrors `AudienceConfigSchema`'s predicates (the
- * schema guards the authoring surface; the runtime receives plain objects) and
- * adds the one cross-field invariant the schema cannot see, on
+ * schema guards the authoring surface; the runtime receives plain objects),
+ * refuses one value the schema does not — an MCP agent ceiling set as the
+ * self-registration set ([ADR-0090 D10]: a self-registrant is a person, and an
+ * agent ceiling is not a person's set) — and adds the one cross-field invariant
+ * the schema cannot see, on
  * `emailAndPassword.requireEmailVerification` (verification is FORCED on by
  * the wiring under both self-registration postures unless noted):
  *
@@ -308,6 +312,15 @@ export function assertAudienceConfig(
         'self-registrant is never a declarable audience.',
       );
     }
+    // [ADR-0090 D10] A self-registrant is a person, and an agent ceiling is not
+    // a person's set: the declaration that names the set refuses one.
+    if (typeof set === 'string' && (MCP_AGENT_PERMISSION_SETS as readonly string[]).includes(set)) {
+      fail(
+        `selfRegistrationPermissionSet must not be '${set}' — it is the permission ceiling of an AI assistant ` +
+        'connected over MCP, which the assistant receives from the access its user consented to, never from an ' +
+        'assignment, and a self-registrant is a person. Declare a permission set meant for people.',
+      );
+    }
     if (emailAndPassword?.requireEmailVerification === false) {
       if (posture === 'email_domain') {
         fail(