@@ -0,0 +1,16 @@
+---
+'@objectstack/service-automation': patch
+---
+
+fix(service-automation): a `runAs: 'user'` run carries its user's posture rung, so a flow run as the platform administrator is served the ledger's deployment-level rows its user's request is served (#28070)
+
+Clause-②: yes (widening) — `RunIdentityContext` (barrel-exported), and so the data context `resolveRunDataContext` answers, gains an optional `posture` member, and `FlowUserGrants` gains one; a `runAs: 'user'` run seeded with `PLATFORM_ADMIN` is served the rows that rung admits.
+Metadata-protocol: none
+
+A request carries the posture rung its user resolves to (`ExecutionContext.posture`, derived in `@objectstack/core`'s `resolveUserAuthzGrants` and copied on by `resolveAuthzContext`). A `runAs: 'user'` automation run seeded the same user's positions, permission sets, peers and email through the same resolver, and no rung. Every reader keyed on the rung then answered the run as for a principal below it. The measured case: after #26750 the compliance ledger's deployment-level rows (`tenant_id` NULL) are served to `PLATFORM_ADMIN` alone, so a flow run as the platform administrator was served organization rows only. That failed closed (fewer rows, never more).
+
+- **Now.** Run setup takes the rung off the resolution it already makes for the run's user (the automation plugin's grants bridge forwards `resolveUserAuthzGrants`' own `posture`; nothing in this package derives one), seeds it beside the positions and permission sets, and every data node carries it to the data engine. The platform administrator's run is served the deployment-level rows, as their request is.
+- **Only with the grants it came from.** The rung is seeded exactly when the run's positions and permission sets are resolved at setup. A context that brought its own grants (a door's pre-resolved envelope, an agent's narrowed ceiling) gains no rung from a re-resolution, so a rung never stands beside grants it was not derived from. A value that names no rung is not carried.
+- **After an approval decision.** The decision switch removes the submitter's rung with their other facts, and the decider's segment carries the decider's own.
+- **Unchanged.** A `runAs: 'system'` run (elevated; no rung is resolved or carried). A member's run is served what the member's request is served, as before: a rung below `PLATFORM_ADMIN` admits nothing a missing one did not, and plugin-security's tenant-wall exemption already enforced the narrower of the carried rung and its capability probe.
+- **Still without a rung.** A run started through the REST or action door, which forwards the request's positions and permission sets but not its rung, keeps failing closed for the rung's readers until that door forwards it.
@@ -224,7 +224,11 @@ A row about no organization (its `tenant_id` empty: a global settings change, a
 user-import run, a platform-admin standing change, a user account created or
 reset through the admin endpoints) is served to the platform
 administrator alone, in every tenancy posture, `single` included; no other
-reader is served one, this capability's holders included.
+reader is served one, this capability's holders included. A `runAs: 'user'`
+flow whose grants the engine resolves for its user (a record-change run, or the
+segment after an approval decision) carries that user's posture, so one run as
+the platform administrator is served these rows as their request is; a run
+started through the REST or action door is not, yet.
 Rows carry the
 ADR-0057 `audit` lifecycle class: retained hot for
 90 days, then archived for seven years where an `archive` datasource is
 
@@ -802,6 +802,15 @@ export interface FlowUserGrants {
    * reads it drops out: the run sees less, never more.
    */
   email?: string;
+  /**
+   * The user's posture rung, derived from the grants above by the resolver a
+   * request's envelope is built through (`resolveUserAuthzGrants`' own field,
+   * under its own name). Run setup seeds it beside the positions and
+   * permission sets ({@link SeededRunContext.posture}). A resolver that omits
+   * it leaves the run without one, so every reader of the rung answers as for
+   * a principal below it: the run sees less, never more.
+   */
+  posture?: SeededRunContext['posture'];
 }
 
 /**
@@ -5655,7 +5664,8 @@ export class AutomationEngine implements IAutomationService {
 
     /**
      * Seed a `runAs:'user'` run context's authorization facts — `positions`,
-     * `permissions`, the peer list `org_user_ids` and the user's `email` — for
+     * `permissions` with the posture rung derived from them, the peer list
+     * `org_user_ids` and the user's `email` — for
      * its `userId`, through the wired grants resolver: the one resolver the
      * request path seeds a request's envelope through
      * (`resolveUserAuthzGrants`, bridged by the automation plugin). Mutates
 
@@ -1457,6 +1457,10 @@ export class AutomationServicePlugin implements Plugin {
                         // policy reading `current_user.email` resolves for the
                         // run as it does for the user's own request.
                         ...(grants.email ? { email: grants.email } : {}),
+                        // The rung the request path carries for this user
+                        // (`resolveAuthzContext` copies it off this same
+                        // resolution), derived once there and never here.
+                        ...(grants.posture ? { posture: grants.posture } : {}),
                         ...(tenantId ? { tenantId } : {}),
                     };
                 });
 
@@ -215,6 +215,11 @@ export async function seedRunGrants(
                     runContext.positions = Array.isArray(grants.positions) ? grants.positions : [];
                     runContext.permissions = Array.isArray(grants.permissions) ? grants.permissions : [];
                     if (grants.tenantId && !runContext.tenantId) runContext.tenantId = grants.tenantId;
+                    // The rung the resolver derived from these same grants,
+                    // as the user's request carries it. Seeded with them and
+                    // only with them: carried grants keep the rung they came
+                    // with, so a narrowed ceiling never gains a wider rung.
+                    if (grants.posture) (runContext as SeededRunContext).posture = grants.posture;
                 }
                 if (needsPeers && Array.isArray(grants.org_user_ids)) {
                     (runContext as SeededRunContext).org_user_ids = grants.org_user_ids;
@@ -309,6 +314,10 @@ async function deciderSegmentContext(
     delete switched.positions;
     delete switched.permissions;
     delete switched.org_user_ids;
+    // The trigger user's rung is theirs: kept under the decider's id, a
+    // platform administrator's submission would hand a member's decision
+    // segment the deployment-level rows. Seeded for the decider below.
+    delete switched.posture;
     // The trigger user's email is theirs too: kept under the decider's id,
     // it would admit the decider to every row an email-keyed policy grants
     // the submitter. Removed on both postures, and seeded for the decider