@@ -0,0 +1,16 @@
+---
+'@objectstack/plugin-security': patch
+---
+
+fix(plugin-security)!: a delegated scope held in a context that names no organization covers nothing
+
+Clause-②: no (narrowing) — the delegated-administration gate resolves a delegated scope only inside the caller's active organization, so a context that names no organization holds no subtree: it covers no business unit and no user, the delegable-scope report lists no scope and no placeable unit — a tenant-level administrator's report included — and a write under the scope is refused naming the missing active organization. Nothing is widened: no export, error code or status is added.
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any schema is added, removed, renamed or re-shaped, and no export of the package entry changes: an adminScope keeps its shape and meaning, and the subtree it names resolves in the caller's active organization only. There is nothing for a migration to rewrite and no tombstone. -->
+
+**BREAKING** accept-set narrowing in the delegated-administration gate (`@objectstack/plugin-security`), only for a context that names no organization.
+
+- **Rule.** A delegated scope held in a context that names no organization covers nothing (ADR-0123 D2: "Tenant-scoped reads resolve to nothing; tenant-scoped writes are refused loudly"). For such a context every answer that reads the scope's subtree is empty: the delegated business-unit read admits nothing, so the read door refuses it `403 PERMISSION_DENIED` as it does for a caller holding no scope; the delegable-scope report lists no scope, no placeable unit and no position assignable through a scope; the explain coverage of a user is false. A tenant-level administrator's delegable-scope report offers such a context no placeable unit either: the units it offers are its active organization's, and a context that names none has none. An assignment or direct grant written under the scope is refused `403 PERMISSION_DENIED` with a message naming the missing active organization, the wording an organization administrator's refusal of the same state already carries.
+- **Unchanged.** A context that names its organization gets every answer it got before, a tenant-level administrator's report included. The writes of a tenant-level administrator, an organization administrator's writes and reports, and a self-delegation of duty are judged as before, and a tenant-level administrator's report still lists the positions it may assign.
+- **Who moves.** Nobody whose sessions carry an active organization: every session on a stock `single` deployment carries the Default Organization (ADR-0131 C1). A caller that reaches the gate with no active organization selects one first.
@@ -134,7 +134,7 @@ const scope = await client.security.describeDelegableScope();
 }
 ```
 
-Three properties worth knowing:
+Four properties worth knowing:
 
 - **It narrows; it does not decide.** The lists are computed by the same
   helpers the write gate enforces with, so an option here is one the gate
@@ -145,8 +145,13 @@ Three properties worth knowing:
   withheld, exactly as the write gate would refuse it.
 - **Strictly self-scoped** — there is no target-user parameter, so it
   discloses nothing beyond the authority you already hold. A tenant-level
-  admin comes back `isTenantAdmin: true` with everything enumerated, so
-  consumers render one uniform picker rather than special-casing.
+  admin comes back `isTenantAdmin: true` with every unit of its active
+  organization enumerated, so consumers render one uniform picker rather than
+  special-casing.
+- **No active organization, no units.** Business units belong to one
+  organization, so a caller whose context names no organization is offered
+  no placeable unit — a tenant-level admin included — and a delegated scope
+  it holds covers nothing.
 
 Scoped invitations (ADR-0105 D8) are the first consumer: the invitation form
 narrows its unit/position pickers with this, and the invitation's placement
 
@@ -33,6 +33,12 @@ const EAST_SCOPE = {
   assignablePermissionSets: ['sales_user'],
 };
 
+/**
+ * [ADR-0123 D2] The organization the fixture tree belongs to and the delegate's
+ * context names: a delegated scope covers units of the active organization only.
+ */
+const ORG = 'org_1';
+
 const SETS: Record<string, any[]> = {
   tenant_admin: [{ name: 'admin_full', objects: { '*': { allowRead: true, modifyAllRecords: true } } }],
   delegate: [{ name: 'east_admin', objects: {}, adminScope: EAST_SCOPE }],
@@ -55,9 +61,9 @@ const CATALOG = {
 function makeQl(tables: Record<string, any[]> = {}) {
   const all: Record<string, any[]> = {
     sys_business_unit: [
-      { id: 'bu_hq', name: 'hq', parent_business_unit_id: null },
-      { id: 'bu_east', name: 'east', parent_business_unit_id: 'bu_hq' },
-      { id: 'bu_west', name: 'west', parent_business_unit_id: 'bu_hq' },
+      { id: 'bu_hq', name: 'hq', parent_business_unit_id: null, organization_id: ORG },
+      { id: 'bu_east', name: 'east', parent_business_unit_id: 'bu_hq', organization_id: ORG },
+      { id: 'bu_west', name: 'west', parent_business_unit_id: 'bu_hq', organization_id: ORG },
     ],
     // Rows say something else on purpose: `rep` is bound to the set NOT on
     // the allowlist, and `mixed` to nothing at all.
@@ -102,7 +108,7 @@ const assign = (gate: DelegatedAdminGate, position: string) =>
     object: 'sys_user_position',
     operation: 'insert',
     data: { user_id: 'u_east_1', position, business_unit_id: 'bu_east' },
-    context: { principal: 'delegate', userId: 'u_delegate' },
+    context: { principal: 'delegate', userId: 'u_delegate', organizationId: ORG },
   });
 
 async function refusal(p: Promise<unknown>): Promise<any> {
@@ -148,7 +154,7 @@ describe('DelegatedAdminGate — a position distributes what its definition decl
 describe('DelegatedAdminGate — describeDelegableScope lists the catalog positions', () => {
   it('a delegate is offered exactly the positions whose declared sets are all allowlisted (anchors excluded)', async () => {
     const gate = gateOver(bindTestSecurityCatalog(makeQl(), CATALOG));
-    const report = await gate.describeDelegableScope(SETS.delegate, { userId: 'u_delegate' });
+    const report = await gate.describeDelegableScope(SETS.delegate, { userId: 'u_delegate', organizationId: ORG });
     expect(report.assignablePositions.sort()).toEqual(['registry_only', 'rep']);
   });
 
 
@@ -41,6 +41,7 @@ import { describe, it, expect, afterEach } from 'vitest';
 import { ObjectQL } from '@objectstack/objectql';
 import { SqlDriver } from '@objectstack/driver-sql';
 import type { PermissionSet } from '@objectstack/spec/security';
+import { resolveThrownHttpError } from '@objectstack/types';
 import { DelegatedAdminGate } from './delegated-admin-gate.js';
 
 const ORG_A = 'org_a_acme';
@@ -237,8 +238,8 @@ describe('DelegatedAdminGate — a scope anchor never crosses an organization',
     expect(report.placeableBusinessUnitIds).not.toContain(b.sales);
   });
 
-  // ── Controls: the assertions above must be able to fail, and the
-  //    organization-less surface must be untouched. ───────────────────────
+  // ── Controls: the assertions above must be able to fail, and a context
+  //    that names no organization holds nothing. ──────────────────────────
   it('control (dark) — one organization holding `sales` resolves it, and the in-org write is approved', async () => {
     const engine = await bootEngine();
     const a = await seedOrganization(engine, ORG_A, 'a');
@@ -265,15 +266,29 @@ describe('DelegatedAdminGate — a scope anchor never crosses an organization',
     );
   });
 
-  it('a `single`-posture caller (no organization in context) keeps the by-name answer', async () => {
+  it('a context that names no organization holds nothing: no scope, no placeable unit, and its write is refused naming the missing active organization', async () => {
     const engine = await bootEngine();
+    const b = await seedOrganization(engine, ORG_B, '0');
     const a = await seedOrganization(engine, ORG_A, 'a');
     const gate = gateOn(engine);
-
-    const report = await gate.describeDelegableScope(DELEGATE_SETS, {
-      principal: 'delegate',
-      userId: 'usr_delegate',
-    });
-    expect([...report.placeableBusinessUnitIds].sort()).toEqual([a.sales, a.salesEast].sort());
+    const noOrganization = { principal: 'delegate', userId: 'usr_delegate', positions: ['sales_admin'] };
+
+    // A context that names no organization holds nothing (ADR-0123 D2).
+    const report = await gate.describeDelegableScope(DELEGATE_SETS, noOrganization);
+    expect(report).toEqual({ isTenantAdmin: false, scopes: [], placeableBusinessUnitIds: [], assignablePositions: [] });
+    for (const [unit, user] of [[a.salesEast, a.user], [b.salesEast, b.user]]) {
+      const refusal: any = await gate.assert({
+        object: 'sys_user_position',
+        operation: 'insert',
+        data: { user_id: user, position: 'sales_rep', business_unit_id: unit },
+        context: noOrganization,
+      }).then(() => null, (e) => e);
+      expect(refusal, `${unit}: expected a refusal`).not.toBeNull();
+      const r = resolveThrownHttpError(refusal);
+      expect([r.status, r.code], `${unit}: ${refusal.message}`).toEqual([403, 'PERMISSION_DENIED']);
+      expect(String(refusal.message)).toMatch(/no active organization/);
+    }
+    // CONTROL: the same delegate, naming its organization, keeps its own subtree.
+    await expect(assignInto(gate, ORG_A, a.salesEast, a.user)).resolves.toBeUndefined();
   });
 });