@@ -0,0 +1,18 @@
+---
+'@objectstack/core': patch
+'@objectstack/plugin-security': patch
+'@objectstack/rest': patch
+'@objectstack/client': patch
+---
+
+feat(security): read one user's effective permission sets, each with where it comes from
+
+Clause-②: yes
+Metadata-protocol: none
+
+A user page could list only the permission sets stored as that user's own grant rows. Sets that arrive through the `everyone` default binding or through a held position were never rows, so a user who holds plenty of access through defaults and positions showed none. Now one read lists them all, each with its origins.
+
+- **`GET /api/v1/security/users/:id/effective-access`** (`@objectstack/rest`, beside `security/explain`) answers the spec's `EffectiveAccess`: the user, the organization it was resolved in, the positions held there, and the permission sets in force, each listed once with every origin it arrives through (`direct`, `position` with the position's name, `default`, or `derived` with its standing). It takes no query parameter: one is refused `400 VALIDATION_ERROR` naming it. A deployment whose security service does not serve the read answers `501`.
+- **Who may read whom is explain's caller gate**, now one function both reads call (`mayDescribeAnotherUser` in `@objectstack/plugin-security`): your own access always; someone else's with `manage_users`, as the organization administrator of an organization they belong to, or with a delegated `adminScope` covering them. An id no user has is refused with the same `403 PERMISSION_DENIED`, word for word, as a user you may not manage, for every caller. This is where the read differs from `security/explain`, which answers an admitted caller `404` for an unknown id.
+- **`ISecurityService.describeEffectiveAccess`** is served by `@objectstack/plugin-security`. The origins come from the resolver itself: `resolveUserAuthzGrants` (`@objectstack/core`) takes a new `withPermissionOrigins` option and returns `permissionOrigins`, recorded where each name is derived. Asking for it is a fresh resolution, like explain's. A resolution that does not ask returns the same envelope as before, from the same reads.
+- **`client.security.describeEffectiveAccess(userId)`** (`@objectstack/client`) returns `EffectiveAccess`.
@@ -111,7 +111,7 @@ bugs — it is the protection or the side effect that silently does not happen.
 | 7 | Write bypass = `true`, effective write scope = `org` | plugin-security | Get: widest write scope without holding any capability | `registerSecurityService` |
 | 8 | Metadata-plane schema masking exempt (ADR-0106 D4) | metadata-core | Get: unmasked object schema. Note: the exemption is a **caller** property — it short-circuits before the security service is consulted | `isObjectSchemaMaskExempt` |
 | 8b | Authoring-trail reads admitted | rest, runtime | Get: a metadata item's version history, audit rows and stored-version diff (`GET /meta/:type/:name/history`, `/audit`, `/diff`) without `studio.access` or `manage_metadata`, and a package's commit timeline (`GET /packages/:id/commits`) without `studio.access`. Note: narrower than the schema-mask exemption the draft switches ask (`isObjectSchemaMaskExempt`): neither door admits `setup.access`, which organization admins hold | `mayReadAuthoringTrail`, `requireCommitTrailReadCapability` |
-| 9 | `explain()` may target a principal other than the caller | plugin-security | Get: no `manage_users` / delegated-admin check | `explainAccessForCaller` |
+| 9 | `explain()` and the effective-access read (`describeEffectiveAccess`) may target a principal other than the caller | plugin-security | Get: no `manage_users` / delegated-admin check — both reads ask the one caller gate | `explainAccessForCaller`, `mayDescribeAnotherUser` |
 | 9b | The master-detail write check the `security` service serves (`checkControlledByParentWrite`, ADR-0055) answers `allow` | plugin-security | Get: `allow` for any record, with no master judged — the write path's own first exit, so a gate composing it admits exactly what the record's own system-context update would. Lose: nothing a caller reaches today: its two consumers, the `sys_attachment` and `sys_comment` parent gates, return before they ask for a system session | `checkControlledByParentWrite` |
 | 10 | Anonymous-deny treats the caller as authenticated | core | Get: passes the 401 seam with no `userId` | `shouldDenyAnonymous` |
 | 12 | Session-resolution middleware skipped | plugin-auth | Get: no session lookup attempted | `packages/plugins/plugin-auth/src/auth-plugin.ts#start` |
@@ -592,7 +592,8 @@ and CI refuses one that differs from what the tree produces.
 | `packages/plugins/plugin-security/src/position-catalog-refusal.ts#assertPositionNamesCatalogRow` | 1 | 23b |
 | `packages/plugins/plugin-security/src/security-plugin-authz-middleware.ts#registerAuthzMiddleware` | 1 | 1, 2, 30 |
 | `packages/plugins/plugin-security/src/security-plugin-cbp-write-gate.ts#checkControlledByParentWrite` | 1 | 9b |
-| `packages/plugins/plugin-security/src/security-plugin-explain-access.ts#explainAccessForCaller` | 2 | 9 |
+| `packages/plugins/plugin-security/src/security-plugin-explain-access.ts#explainAccessForCaller` | 1 | 9 |
+| `packages/plugins/plugin-security/src/security-plugin-explain-access.ts#mayDescribeAnotherUser` | 1 | 9 |
 | `packages/plugins/plugin-security/src/security-plugin-field-readers.ts#resolveProjectionFieldMask` | 1 | 4 |
 | `packages/plugins/plugin-security/src/security-plugin-object-admission.ts#canExport` | 1 | 5 |
 | `packages/plugins/plugin-security/src/security-plugin-object-admission.ts#canReadObject` | 1 | 6 |
 
@@ -176,6 +176,7 @@ import type {
   AudienceBindingSuggestionSync,
   AutomationResult,
   DelegableScope,
+  EffectiveAccess,
   FlowRuntimeState,
   ImportObjectResult,
   ObjectDraft,
@@ -6626,6 +6627,24 @@ export class ObjectStackClient {
           return this.unwrapResponse<DelegableScope>(res);
       },
 
+      /**
+       * ADR-0090 D6/D12 — one user's effective permission sets, each with
+       * every origin it arrives through: a default binding, a held position,
+       * a direct grant, or a name derived from the user's standing. Resolved
+       * in the caller's organization by the resolver enforcement uses.
+       *
+       * Gated as `explain` is: reading someone else needs `manage_users`,
+       * organization administration covering them, or a delegated
+       * `adminScope` covering them. An unknown id is refused with the same
+       * `403` as one the caller may not manage.
+       */
+      describeEffectiveAccess: async (userId: string): Promise<EffectiveAccess> => {
+          const res = await this.fetch(
+              `${this.baseUrl}/api/v1/security/users/${encodeURIComponent(userId)}/effective-access`,
+          );
+          return this.unwrapResponse<EffectiveAccess>(res);
+      },
+
       suggestedBindings: {
           /** List suggestions, optionally by `status` / `packageId` (reconciles first). */
           list: async (opts?: { status?: string; packageId?: string }): Promise<{ suggestions: AudienceBindingSuggestion[]; synced: AudienceBindingSuggestionSync }> => {
 
@@ -84,6 +84,7 @@ import type {
     AnalyticsResult,
     AutomationResult,
     DelegableScope,
+    EffectiveAccess,
     FlowRuntimeState,
     FlowUnboundCause,
     ImportObjectResult,
@@ -139,6 +140,8 @@ export async function returnTypePrecisionPins(): Promise<void> {
     // ── shape class 1: the contract type, served bare ────────────────────
     // `res.json(await svc.describeDelegableScope(context))` — no envelope.
     expectTypeOf(await client.security.describeDelegableScope()).toEqualTypeOf<DelegableScope>();
+    // `res.json(await svc.describeEffectiveAccess(id, context))` — no envelope.
+    expectTypeOf(await client.security.describeEffectiveAccess('u1')).toEqualTypeOf<EffectiveAccess>();
 
     // ── shape class 2: contract type inside a route-built ENVELOPE ───────
     // The census's highest-risk band: `sendOk(res, { tables })` means the
@@ -235,6 +238,9 @@ export async function returnTypePrecisionPins(): Promise<void> {
     // @ts-expect-error a DelegableScope is not a string
     const wrongScope: string = await client.security.describeDelegableScope();
 
+    // @ts-expect-error an EffectiveAccess is not a bare list of permission sets
+    const wrongAccess: EffectiveAccess['permissionSets'] = await client.security.describeEffectiveAccess('u1');
+
     // @ts-expect-error the route answers `{ tables }`, not a bare array
     const wrongTables: RemoteTable[] = await client.datasources.external.listTables('ds');
 
@@ -254,6 +260,7 @@ export async function returnTypePrecisionPins(): Promise<void> {
     const wrongClone: CloneDataResult = await client.data.create('lead', {});
 
     void wrongScope;
+    void wrongAccess;
     void wrongTables;
     void wrongFlow;
     void wrongSearch;
 
@@ -56,7 +56,12 @@ const GRANTS = [
   { permission_set: 'elsewhere', organization_id: ORG_B },
 ];
 
-async function resolve(tenantId: string | undefined, ledger: unknown[] = []) {
+async function resolve(tenantId: string | undefined, ledger: unknown[] = [], extra: { withPermissionOrigins?: boolean } = {}) {
+  const { out } = await resolveRecorded(tenantId, ledger, extra);
+  return out;
+}
+
+async function resolveRecorded(tenantId: string | undefined, ledger: unknown[] = [], extra: { withPermissionOrigins?: boolean } = {}) {
   const ql = bindStaticSecurityCatalog(makeRecordingQl({
     sys_user: [{ id: 'u1', email: 'u1@example.com' }],
     sys_member: [{ user_id: 'u1', organization_id: ORG_A, role: 'member' }, { user_id: 'u1', organization_id: ORG_B, role: 'member' }],
@@ -67,7 +72,8 @@ async function resolve(tenantId: string | undefined, ledger: unknown[] = []) {
     sys_permission_set: [],
     sys_metadata_activation: ledger,
   }), definitions);
-  return resolveUserAuthzGrants(ql, 'u1', tenantId ? { tenantId } : {});
+  const out = await resolveUserAuthzGrants(ql, 'u1', { ...(tenantId ? { tenantId } : {}), ...extra });
+  return { out, calls: (ql as any).calls as Array<{ object: string }> };
 }
 
 describe('[#25799] directPermissions is the resolver\'s own direct channel', () => {
@@ -97,3 +103,28 @@ describe('[#25799] directPermissions is the resolver\'s own direct channel', ()
     expect(out.directPermissions).toEqual(['both_channels']);
   });
 });
+
+describe('[ADR-0090 D6] withPermissionOrigins records each name\'s channels, and changes nothing else', () => {
+  it('a set reached through a grant row and the `everyone` anchor carries both, in channel order; each other name its one', async () => {
+    const out = await resolve(ORG_A, [], { withPermissionOrigins: true });
+    expect(out.permissionOrigins).toEqual({
+      tools: [{ kind: 'direct' }],
+      both_channels: [{ kind: 'direct' }, { kind: 'default' }],
+      definition_only: [{ kind: 'default' }],
+    });
+  });
+
+  it('a switched-off set keeps no origin, since the envelope does not hold it', async () => {
+    const out = await resolve(ORG_A, [{ metadata_type: 'permission', name: 'tools', package_id: null, active: false }], { withPermissionOrigins: true });
+    expect(out.permissionOrigins).not.toHaveProperty('tools');
+  });
+
+  it('the envelope and the reads are byte-identical to a resolution that did not ask', async () => {
+    const plain = await resolveRecorded(ORG_A);
+    const asked = await resolveRecorded(ORG_A, [], { withPermissionOrigins: true });
+    expect(plain.out).not.toHaveProperty('permissionOrigins');
+    const { permissionOrigins: _origins, ...rest } = asked.out;
+    expect(rest).toEqual(plain.out);
+    expect(asked.calls.map((c) => c.object)).toEqual(plain.calls.map((c) => c.object));
+  });
+});
@@ -65,7 +65,7 @@ import { SystemObjectName } from '@objectstack/spec/system';
 import type { AuthzPosture, TenancyPosture } from '@objectstack/spec/security';
 import { postureEnforcesWall } from '@objectstack/spec/security';
 import { isValueDomainMember } from '@objectstack/spec/shared';
-import type { AuthSessionApi } from '@objectstack/spec/contracts';
+import type { AuthSessionApi, EffectivePermissionSetOrigin } from '@objectstack/spec/contracts';
 
 import { ApiKeyLifecycleRefusalError, resolveApiKeyAdmission } from './api-key.js';
 import type { ApiKeyLifecyclePolicySource, ApiKeyRefusalReason } from './api-key.js';
@@ -879,6 +879,22 @@ export interface UserAuthzGrants {
   audience?: 'external';
   /** The user's unique email (`sys_user`), for `current_user.email` owner RLS. */
   email?: string;
+  /**
+   * [ADR-0090 D6] Where each name in `permissions` came from, keyed by name —
+   * present only when the caller asked for it
+   * ({@link ResolveUserAuthzGrantsOptions.withPermissionOrigins}). Recorded at
+   * the derivation sites themselves, so it cannot disagree with them: `direct`
+   * where an applying grant row of the user's own names an active set (the
+   * `directPermissions` channel), `position` / `default` where a held
+   * position's definition in force names it (`default` for the `everyone`
+   * audience anchor, whose bindings are the default ones), and `derived` where
+   * the configured platform administrators (§6b-config) or the `ai_access` flag
+   * (§7) confer the name. Every name in `permissions` the resolution derived has
+   * at least one origin, each listed once, in the order the envelope lists its
+   * channels — `direct`, then `position` (in held-position order), `default`,
+   * `derived`; a `seedPermissions` name the caller supplied has none.
+   */
+  permissionOrigins?: Record<string, EffectivePermissionSetOrigin[]>;
 }
 
 export interface ResolveUserAuthzGrantsOptions {
@@ -920,6 +936,16 @@ export interface ResolveUserAuthzGrantsOptions {
    * would then trust.
    */
   bypassGrantsCache?: boolean;
+  /**
+   * [ADR-0090 D6] Record where each permission-set name came from, in
+   * {@link UserAuthzGrants.permissionOrigins}. For a surface that DESCRIBES a
+   * user's access (`ISecurityService.describeEffectiveAccess`), never for
+   * enforcement: the envelope is otherwise byte-identical to a resolution
+   * without it. It implies {@link bypassGrantsCache}, for the explainer's ruled
+   * reason: a description is what an administrator reads to verify a change
+   * took effect, and an origin map is recorded only by a resolution that ran.
+   */
+  withPermissionOrigins?: boolean;
 }
 
 /**
@@ -1839,12 +1865,29 @@ export async function resolveUserAuthzGrants(
   // read HERE, before any read of this resolution is issued. Outside that
   // scope (every direct caller of this function) it is `undefined` and nothing
   // changes.
-  const requestMemo = openRequestGrantsMemo(ql, userId, opts, readWriteEpoch(ql));
+  // [ADR-0090 D6] An origin map is recorded only by a resolution that runs, so
+  // asking for one is a fresh resolution (see `withPermissionOrigins`).
+  const cacheOpts = opts.withPermissionOrigins ? { ...opts, bypassGrantsCache: true } : opts;
+  const requestMemo = openRequestGrantsMemo(ql, userId, cacheOpts, readWriteEpoch(ql));
   if (requestMemo?.hit) return requestMemo.hit;
 
-  const grantsCache = openUserGrantsCache(ql, userId, opts);
+  const grantsCache = openUserGrantsCache(ql, userId, cacheOpts);
   if (grantsCache?.hit) return grantsCache.hit;
 
+  // [ADR-0090 D6] The origin record, when asked for: each origin once per name.
+  // Ordered by channel when the envelope is returned (see `permissionOrigins`).
+  const origins = opts.withPermissionOrigins ? new Map<string, EffectivePermissionSetOrigin[]>() : undefined;
+  const recordOrigin = (name: string, origin: EffectivePermissionSetOrigin): void => {
+    if (!origins) return;
+    const list = origins.get(name) ?? [];
+    const same = (o: EffectivePermissionSetOrigin): boolean =>
+      o.kind === origin.kind
+      && (o.kind !== 'position' || (origin.kind === 'position' && o.position === origin.position))
+      && (o.kind !== 'derived' || (origin.kind === 'derived' && o.source === origin.source));
+    if (!list.some(same)) list.push(origin);
+    origins.set(name, list);
+  };
+
   const { tenantId } = opts;
   const grants: UserAuthzGrants = {
     positions: [],
@@ -2138,9 +2181,13 @@ export async function resolveUserAuthzGrants(
   if (disabled.positions.size > 0) {
     grants.positions = grants.positions.filter((n) => !disabled.positions.has(n));
   }
-  for (const setNames of setsInForceByPosition(grants.positions, namedByPosition, disabled).values()) {
+  for (const [positionName, setNames] of setsInForceByPosition(grants.positions, namedByPosition, disabled)) {
     for (const setName of setNames) {
       if (!boundSetNames.includes(setName)) boundSetNames.push(setName);
+      // [ADR-0090 D5] The `everyone` anchor's bindings are the default ones.
+      recordOrigin(setName, positionName === 'everyone'
+        ? { kind: 'default' }
+        : { kind: 'position', position: positionName });
     }
   }
 
@@ -2168,6 +2215,7 @@ export async function resolveUserAuthzGrants(
     // [#25799] The direct channel, as the explainer reads it: a name this
     // resolution confers through the user's own grant row.
     if (active && !grants.directPermissions.includes(name)) grants.directPermissions.push(name);
+    if (active) recordOrigin(name, { kind: 'direct' });
     // platform_admin (ADR-0068 D2) is DERIVED from the anchoring admin_full_access
     // USER grant — the single source of truth (no trusted stored boolean). The
     // set is the catalog's one `admin_full_access` (ADR-0131 D4); a grant the
@@ -2235,6 +2283,7 @@ export async function resolveUserAuthzGrants(
     // envelope a grant-derived one carries.
     hasPlatformAdminGrant = true;
     if (!grants.permissions.includes(ADMIN_FULL_ACCESS)) grants.permissions.push(ADMIN_FULL_ACCESS);
+    recordOrigin(ADMIN_FULL_ACCESS, { kind: 'derived', source: 'platform_admin_config' });
     for (const p of ADMIN_FULL_ACCESS_CAPABILITIES.systemPermissions ?? []) {
       if (!grants.systemPermissions.includes(p)) grants.systemPermissions.push(p);
     }
@@ -2282,9 +2331,28 @@ export async function resolveUserAuthzGrants(
 
   // 7. [cloud ADR-0024 §7] Env-side AI seat: synthesize the `ai_seat` capability from the
   //    boolean sys_user.ai_access (sqlite returns 1/0; memory returns boolean).
-  if (!grants.permissions.includes('ai_seat')) {
+  //    An origin record reads the flag even when another channel already named
+  //    `ai_seat`, so a name reached both ways carries both origins; the row is
+  //    the memoised one, and the envelope is unchanged.
+  if (!grants.permissions.includes('ai_seat') || origins) {
     const aiAccess = ((await getUserRow()) as { ai_access?: unknown } | undefined)?.ai_access;
-    if (aiAccess === true || aiAccess === 1 || aiAccess === '1') grants.permissions.push('ai_seat');
+    if (aiAccess === true || aiAccess === 1 || aiAccess === '1') {
+      if (!grants.permissions.includes('ai_seat')) grants.permissions.push('ai_seat');
+      recordOrigin('ai_seat', { kind: 'derived', source: 'ai_access' });
+    }
+  }
+
+  // [ADR-0090 D6] Only names the envelope holds keep an origin: a bound name
+  // the catalog holds no set for, or a switched-off set, confers nothing.
+  if (origins) {
+    const channelRank: Record<EffectivePermissionSetOrigin['kind'], number> = { direct: 0, position: 1, default: 2, derived: 3 };
+    const permissionOrigins: Record<string, EffectivePermissionSetOrigin[]> = {};
+    for (const name of grants.permissions) {
+      const list = origins.get(name);
+      // A stable sort: positions keep the held-position order they were reached in.
+      if (list) permissionOrigins[name] = [...list].sort((a, b) => channelRank[a.kind] - channelRank[b.kind]);
+    }
+    grants.permissionOrigins = permissionOrigins;
   }
 
   // [#11971] Store the fresh envelope (miss path only; the argument list is