Delete user permission override

Delete the exact selected user override after checking its stored organization authority; effective access needs separate evaluation.

Outcome

Delete the exact selected user override after checking its stored organization authority; effective access needs separate evaluation.

These examples prove local handler behavior with real isolated SQL and explicitly simulated identity/permission dependencies.

Before you start

Verify the intended authenticated identity and the current credential-scoped action before preparing input. Self and managed-user security operations have different authority; an override id does not authorize a different user or organization.
Use authorized identity and user/session discovery. Recovery security data and session/device identifiers must remain inside the caller-approved workflow.
Review the validated plan and intended effect before confirmation. Allow/deny changes and deny removal can change effective access. Capture current rows and evaluate the reviewed user/organization/application permissions before and after the confirmed decision. Fixture examples authorize no live mutation or external delivery.

Discover the target

topolo whoami --json
topolo apps --json
topolo actions get app_topolo_auth.user_permission_overrides.delete --detail --json

Discover the exact user and organization membership, application and service_permissions.list entries. Read user_permission_overrides.list with exact org/app filters; use its row id, user and organization together. Read user_permissions.get separately for effective access.

Input fields

Field	Required	Meaning
`userId`	Yes	Existing Topolo identity from authorized user discovery. Read allows self or a permitted manager. Writes require an organization administrator role and authority over the actual override organization, not merely a known row id.
`overrideId`	Yes	Exact stored override id from user_permission_overrides.list for this target user and organization. Deletion binds row id, target user and checked stored organization. Keep duplicate ids separate and remove only the specifically approved row.

Effects

Deletes only the approved user/override/organization row after stored-organization authority checks.
Preserves other overrides and app/role assignments; removing a deny can increase access. Audit errors are nonfatal.

Interpret the response

Raw target successes have success/message/data/timestamp; creation is HTTP 201 and read/delete are 200. CLI/MCP may wrap or project the response. Stored fields are snake_case with epoch seconds; the envelope timestamp is ISO text. Fixtures prove local canonical SQL/handler behavior with simulated token identity, target memberships and permission catalog partitions, not live effective permission enforcement.

Deletion reads the exact override/user pair, checks authority over its stored organization, and binds deletion to id/user/organization. data.userId/overrideId/orgId identify the acknowledged row. A foreign user id through an authorized URL is NOT_FOUND; another organization row for the same user is refused unless the caller can manage that stored organization. The row organization, rather than target active display context, determines deletion authority.

Repeated deletion returns NOT_FOUND. Removing an allow can reduce access; removing a deny can increase it. Other duplicate rows, roles, app assignments and permissions remain, so deleted true does not prove the final effective access. Audit is nonfatal and records the affected row organization/application.

The existing organization-admin role gate remains required. A direct platform role alone is insufficient; authenticated organization authority denial can be AUTH_ERROR. Keep discovered ids with their user and organization; no row id authorizes a different boundary.

Worked examples

These are complete raw target-handler responses, not CLI/gateway envelopes or live authorization proof. Replace synthetic identifiers using authorized discovery. Save only the reviewed input as payload.json; inspect validation and plan before executing. --confirm assumes the intended operation is approved. Storage read-back and actual sign-in outcomes require separate verification. Explicit rows do not assign app access or seats, and duplicate/conflicting overrides can remain. Removing a deny can increase access. Cookies and Bearer tokens must identify the intended principal consistently.

Stored-row organization admin can delete despite target active organization being different

Input · payload.json:

{
  "userId": "usr_managed",
  "overrideId": "upo_foreign_org"
}

CLI:

topolo actions validate app_topolo_auth.user_permission_overrides.delete --data @payload.json --json
topolo actions plan app_topolo_auth.user_permission_overrides.delete --data @payload.json --confirm --json
topolo actions call app_topolo_auth.user_permission_overrides.delete --data @payload.json --confirm --json

MCP call after validation and plan review:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_auth.user_permission_overrides.delete",
    "input": {
      "userId": "usr_managed",
      "overrideId": "upo_foreign_org"
    },
    "confirm": true
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "User permission override deleted",
  "data": {
    "userId": "usr_managed",
    "overrideId": "upo_foreign_org",
    "orgId": "org_other",
    "deleted": true
  },
  "timestamp": "2026-10-02T00:00:00.000Z"
}

Delete binds override id, target user and authorized row organization

Input · payload.json:

{
  "userId": "usr_managed",
  "overrideId": "upo_FfLusJrOwlvd"
}

CLI:

topolo actions validate app_topolo_auth.user_permission_overrides.delete --data @payload.json --json
topolo actions plan app_topolo_auth.user_permission_overrides.delete --data @payload.json --confirm --json
topolo actions call app_topolo_auth.user_permission_overrides.delete --data @payload.json --confirm --json

MCP call after validation and plan review:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_auth.user_permission_overrides.delete",
    "input": {
      "userId": "usr_managed",
      "overrideId": "upo_FfLusJrOwlvd"
    },
    "confirm": true
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "User permission override deleted",
  "data": {
    "userId": "usr_managed",
    "overrideId": "upo_FfLusJrOwlvd",
    "orgId": "org_example",
    "deleted": true
  },
  "timestamp": "2026-10-02T00:00:00.000Z"
}

Deny removal is successful despite nonfatal audit failure; effective access needs independent evaluation

Input · payload.json:

{
  "userId": "usr_managed",
  "overrideId": "upo_JnwqYI7Kow_Z"
}

CLI:

topolo actions validate app_topolo_auth.user_permission_overrides.delete --data @payload.json --json
topolo actions plan app_topolo_auth.user_permission_overrides.delete --data @payload.json --confirm --json
topolo actions call app_topolo_auth.user_permission_overrides.delete --data @payload.json --confirm --json

MCP call after validation and plan review:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_auth.user_permission_overrides.delete",
    "input": {
      "userId": "usr_managed",
      "overrideId": "upo_JnwqYI7Kow_Z"
    },
    "confirm": true
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "User permission override deleted",
  "data": {
    "userId": "usr_managed",
    "overrideId": "upo_JnwqYI7Kow_Z",
    "orgId": "org_example",
    "deleted": true
  },
  "timestamp": "2026-10-02T00:00:00.000Z"
}

Verify the result

Read the exact target org/app overrides and require the acknowledged id to be absent; check other users and organization rows remain unchanged.
Read current user_permissions.get and test the intended protected request as the affected user. An absent row cannot by itself prove access removal or restoration when other grants/denies remain.

Errors and recovery

Authorized target URL cannot delete another user override

Captured local refusal · HTTP 404:

{
  "input": {
    "userId": "usr_managed",
    "overrideId": "upo_foreign_user"
  },
  "response": {
    "success": false,
    "error": {
      "message": "Override not found",
      "code": "NOT_FOUND",
      "details": null,
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Same user override in another organization requires that row organization authority

Captured local refusal · HTTP 401:

{
  "input": {
    "userId": "usr_managed",
    "overrideId": "upo_foreign_org"
  },
  "response": {
    "success": false,
    "error": {
      "message": "Access denied: You can only delete overrides within your organization",
      "code": "AUTH_ERROR",
      "details": null,
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Repeated delete reports NOT_FOUND

Captured local refusal · HTTP 404:

{
  "input": {
    "userId": "usr_managed",
    "overrideId": "upo_FfLusJrOwlvd"
  },
  "response": {
    "success": false,
    "error": {
      "message": "Override not found",
      "code": "NOT_FOUND",
      "details": null,
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Ordinary self cannot delete an administrator override

Captured local refusal · HTTP 401:

{
  "input": {
    "userId": "usr_managed",
    "overrideId": "upo_E-G6cLsM_852"
  },
  "response": {
    "success": false,
    "error": {
      "message": "Admin access required",
      "code": "AUTH_ERROR",
      "details": null,
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Anonymous override deletion is refused

Captured local refusal · HTTP 401:

{
  "input": {
    "userId": "usr_managed",
    "overrideId": "upo_E-G6cLsM_852"
  },
  "response": {
    "success": false,
    "error": {
      "message": "Access token required",
      "code": "AUTH_ERROR",
      "details": null,
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Exact-row lookup failure is not successful deletion

Captured local refusal · HTTP 500:

{
  "input": {
    "userId": "usr_managed",
    "overrideId": "upo_E-G6cLsM_852"
  },
  "response": {
    "success": false,
    "error": {
      "message": "Isolated exact override SQL failure",
      "code": "SERVER_ERROR",
      "details": null,
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Published recovery guidance

state_conflict (HTTP 409): Read the current resource state, reconcile the intended change, and retry only if still valid.
VALIDATION_ERROR (HTTP 400): Correct fields and resolve the target organization membership through authorized identity discovery. An app permission name must be declared; stored-row metadata does not assign an app entitlement.
AUTH_ERROR (HTTP 401): Verify approved identity, organization-admin role, exact row organization authority and transport. Authenticated role/authority denial also uses 401; do not assume expiry or switch credential context automatically.
NOT_FOUND (HTTP 404): Refresh the exact user/organization/application row list. Missing target or already-deleted/exact-user-mismatched override is not a successful new deletion.
SERVER_ERROR (HTTP 500): Preserve the original error and rediscover current rows before reviewing a retry. Unknown permission names, token exceptions or storage errors are possible. Creation has no idempotency key; blindly retrying an unknown outcome can duplicate an override.

Recovery boundaries

Recreating a captured effect/expiry is a new approved permission decision with a new id and current declared permission/membership checks. It is not restoration of the original identity or timestamp and must account for the current effective access/duplicates. Never recreate an expired allow as unbounded or treat zero as an expiry.

Discovery and evidence

This record belongs to app_topolo_auth. Local tests prove real canonical override SQL, declared permission validation and exact stored-row organization authority with simulated tokens, target memberships and a permission catalog partition. They do not prove actual app assignment, effective access enforcement, live permissions, deployment or production completion.