Repository navigation
docs(governance): write GL-10 supplier portal account and information security rules - #89
Merged
Merged
Conversation
… security rules New template governance/templates/core/GL-10.md (index.yaml: written), following 04 §3 and ADR-0010: portal as the formal channel (R5), invite-only registration and no attachments on the public form, opening by the org admin only (category managers request), external-member accounts, one account per supplier, per-person portal admin, revocation (contact leaves, eliminate / blacklist, admission rejected), quarterly account review, zero visibility between suppliers, sealed bids, platform maintenance access and personal information. Section 7 maps every system clause to its control. Kept the other documents in step: - QP-01 6.2.2, GL-01 6.1.1/6.1.3: invitation is the default way to register; the public entry takes no attachments; portal accounts opened per GL-10 - SP-01 1.6: no lending accounts, tell the company to deactivate leavers - ZC-03: new R2-09 portal account risk (soe row moves to R2-10); R2-02 cites GL-10 - forms QR-17 (account request) and QR-18 (quarterly review); org key dept.it - 04: srm_portal_admin naming, supplier_admin only requests the portal, admission rejection revocation row, GL-10 6.8 for database-level access Claude-Session: https://claude.ai/code/session_017ihL2fXqdhhmZ1JoJ86htw Co-authored-by: Claude <noreply@anthropic.com>
This was referenced Nov 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by 田騏 · project thread
Closes #83（v0.6 U7）。
改了什么
新写
governance/templates/core/GL-10.md《供应商门户账号与信息安全管理规定》，index.yaml改为written。按 04 §3 与 ADR-0010（方案 B 成员键）编写：external（外部成员）邀请并运行「开通门户」；一人一号、一个账号只登记在一家供应商；不再有每家供应商一个岗位（ADR-0010）；portal_user）只由流程写；内部权限不设默认授予；同步的其他文件（ADR-0005 双向核对）
dept.it（信息技术部门）record_retention_years.used_in加 GL-10srm_portal_admin（与代码一致）、srm_supplier_admin只提开通需求；§3.3 回收表加「准入未通过」行（只在供应商退回 potential / eliminated 时清portal_user，已合格供应商加品类被驳回不动门户）；§4.1 指向 GL-10 6.8留给 U3（#79）：03 §13 自动化清单里
srm_portal_enable的操作人仍写srm_supplier_admin，应为组织管理员（04 §3.3）；准入驳回清portal_user、邀请过期、一账号一家检查、季度复核报表这几条 GL-10 第 7 章的控制由 U3 实现。为避免和 U3 冲突，本 PR 没动 03。怎么验证的
python3 governance/scripts/build.py --check：通过（19 个文件）python3 governance/scripts/build.py --check --packs bulk,hazmat,soe：通过（19 个文件）Generated by Claude Code