UX Spec: Ranked Attributes

1. Overview

Ranked Attributes introduces an ordered attribute type to Custom Profile Attributes. Today, an admin who wants to write a policy like "Secret or above" has to hand-enumerate every eligible clearance value in CEL. Ranked Attributes lets them assign an integer rank to each option and use comparison operators (≥, ≤) in the policy editor instead. It also unlocks read-only ingestion of ordered schemas from external User Authoritative Sources (UAS).

Who uses it. System Admins setting up the schema and writing global policies. Channel and Team Admins writing scoped policies that reference the same attributes.

What this spec covers. Only the user experience added by this feature. Custom Profile Attribute behavior that already exists — the attribute table, the row overflow menu, the per-user attribute editor in System User Detail, the policy editor's existing operators, the CEL/Advanced mode, the LDAP/SAML linking — is unchanged and not restated here.

2. Scope

In scope (v1.0):

• A new "Ranked" attribute type alongside the existing types (Text, Select, Multiselect, Date, User, Multiuser).

• UI to set and edit the rank of each option in a ranked schema.

• Comparison operators in the Membership Policy editor for ranked attributes: is exactly, is not, is at least, is greater than, is at most, is less than. The strict and equality operators that already exist for other types keep their behavior; the four inequality operators are new.

• A visibility rule for ranked attributes that activates only when the attribute has access_mode = shared_only (see §4.1). For ranked attributes without shared_only, all values remain visible on user-facing surfaces.

• Hard-block on deletion of any attribute or option that is referenced by an active policy.

• Read-only display for ranked schemas mirrored from external User Authoritative Sources.

Nice to have (v1.0 stretch):

• An "Access mode" submenu in the row overflow menu where admins can set the read-access semantic per attribute (Public or Shared-only). Without this UI, the default for admin-created attributes is Public; plugins can still set shared_only programmatically via the property service. Shipping the visibility rule (§4.1) does not depend on this admin UI.

Out of scope (v1.0):

• Per-value color customization for ranked options. (Standard Select options keep their existing color treatment.)

• Showing rank numbers anywhere outside the schema admin surfaces — not in user profiles, the policy editor value picker, denial messages, or directory views.

• Multiple options sharing the same rank. Every option carries a unique integer.

• Hierarchical (tree-structured) attributes. Tracked separately for a follow-on release.

• A cross-surface "stale data" admin banner. Stale UAS schemas fail secure at evaluation time; no proactive UI warning.

• Force-override on the delete gate.

3. Surfaces

Three System Console surfaces gain new behavior. Existing chrome (sidebar, page header, footer Save/Cancel, profile card, ConsolePropertyTable, AdminPanel) is unchanged.

3.1 User Attributes — schema authoring

System Console → System Attributes → User Attributes

Open

New: the "Ranked" attribute type. Appears in the type chooser alongside the existing five types. Picking Ranked creates an empty schema and auto-focuses the schema name input, same as the existing flow for other types.

New: rank-prefixed value chips. In a row of type Ranked, each option chip carries a small numbered badge in front of the label (e.g., 4 Top Secret). Chips render left-to-right in ascending rank order (rank 1 on the left, highest on the right). Standard Select chips are unchanged.

Open

New: per-chip popover. Click a chip in a Ranked row to open an inline editor with three items:

• Text input for the option label (commits on Enter or blur).

• "Rank" item showing the current rank with a (Lowest) / (Highest) suffix on the endpoints and a chevron into a submenu of available rank positions.

• Destructive "Remove option" item.

Click outside or press Esc to close. Focus returns to the originating chip.

New: Adding a new value auto-assigns the next rank. Useful for quick additions without opening the modal.

Open

New: "Edit ranking" item in the row overflow menu. Figma 4215-37673. Added as the first item, above the existing Visibility / Editable by users / Link to AD/LDAP / Duplicate / Delete items. The Visibility submenu and other items are unchanged.

Open

New: Ranked schema modal. Opens from "Edit ranking" in the overflow menu. The deep-edit surface for the schema. One row per option, with a drag handle, name input, a numeric rank input, a destructive remove button, and an "+ Add value" affordance at the bottom. Drag-to-reorder reassigns rank numbers atomically. A numeric edit that collides with another option's rank is rejected inline. "+ Add value" appends with the next integer (max + 1).

Open

Nice to have: "Access mode" submenu in the row overflow menu. Two options, with secondary text:

If the submenu ships in v1.0, it sits between Visibility and Editable by users. If it doesn't, admin-created attributes default to Public; plugins can still set Shared-only programmatically (and the visibility rule in §4.1 fires for any attribute with access_mode = shared_only regardless of how it was set).

A third mode, Source-only, exists in the underlying property service for plugin-managed attributes but is not surfaced in the admin submenu.

Open

3.2 Membership Policy editor — new operators for ranked attributes

System Console → System Attributes → Membership Policies → [policy]

New: comparison operators for ranked attributes only. When the selected Attribute is of type Ranked, the operator dropdown shows the following set:

Equality pair first, then the greater pair (inclusive then strict), then the less pair (inclusive then strict). For non-ranked attributes, the operator dropdown shows the existing set unchanged (is, is not, in, has any of, has all of, and the string operators).

Open

Chip rendering. The value chip in the Values column displays the value label only. The rank number is not surfaced in this view.

3.3 User Configuration — Clearance picker for ranked attributes

System Console → User Management → Users → [user]. Prototype page mirrors the existing System User Detail layout; only the ranked-value picker is new.

New: ranked-value picker. When configuring a user's attribute of type Ranked, the value picker is a menu that renders:

• Values in top-down order, highest rank first.

• Each option with a small numbered badge prefix.

• A trailing checkmark on the currently selected value.

Visible values depend on the attribute's Access mode:

• Public — all values in the schema are present. The admin can assign any value.

• Shared-only — the picker is filtered to values at or below the signed-in admin's own rank for that attribute. An admin cannot assign a rank higher than their own, because under shared-only the admin cannot see those values at all. (This is the program-masking semantic — plugins create attributes where even admins can't see the full namespace.)

• Source-only — the picker is read-only. Value assignment is owned by the source plugin; the admin cannot change it from this surface.

Other attribute types on this page are unchanged.

Open

4. Behavior rules

4.1 Visibility rule for ranked values under Shared-only access mode

The rule below applies only to ranked attributes whose Access mode is set to Shared-only. For ranked attributes with Access mode unset (Public) the underlying value is visible to all viewers; the rule does not apply.

Rule. When viewer V sees subject S's value for a ranked attribute with Shared-only access:

• The displayed value is the highest rank in the schema that is at or below both V's rank and S's rank for that attribute (mathematically, min(rank_V, rank_S)).

• If V has no value for the attribute, the chip is empty.

Worked examples. Schema: Unclassified (1) < Confidential (2) < Secret (3) < Top Secret (4).

Why. In Shared-only mode, the displayed value is a collaboration signal — what V and S can safely collaborate at — not a capability signal (what S can independently access). V cannot tell whether S's true rank exceeds the displayed value, only that it is at least the displayed value.

Scope of application. Wherever a viewer encounters another user's value or a list of values for a Shared-only attribute and the System Console User Configuration picker. On the configuration picker, the viewer is the signed-in admin, so the admin can only see and assign values at or below their own rank. The picker collapse is the same min() rule applied to the admin-as-viewer.

Enforcement is server-side. The viewer's client never receives the subject's true value when Shared-only is set; the server returns the computed min() value (or empty).

Compliance grounding. Maps to NIST 800-53 AC-16(5) (attribute display restrictions), with supporting controls AC-6 (least privilege) and SC-4 (information in shared system resources). Neither DoD nor NATO doctrine prescribes this specific rule — they regulate object access, not label-namespace visibility — but both are compatible with it.

The same rule applies to all ranked attributes with Shared-only set, including non-clearance attributes (severity, priority, workflow stage). Admins who don't want this semantic for those attributes simply leave Access mode at Public.

4.2 Unique ranks

Every option in a ranked schema carries a unique integer of at least 1. The UI auto-assigns on add (max existing + 1). Editing the rank field to a duplicate or to zero/empty is rejected inline with a message such as Rank 3 is already used by "Secret." Drag-to-reorder swaps positions atomically; no transient duplicate state is visible.

4.3 Hard-block on deletion of referenced options

When an option or attribute is referenced by at least one active membership policy, the destructive affordances are disabled — not confirmation-gated. The tooltip on the disabled affordance reads Used in N policies; cannot delete. Admins must remove the policy references first.

Applies to:

• The "Remove option" item in the per-chip popover

• The per-row remove button inside the Ranked schema modal

• The "Delete property" item in the row overflow menu

• The row delete in the Membership Policy editor's Attribute requirements table (existing affordance; gate is new)

There is no force-override.

4.4 Rank visibility scope

Rank integers are visible only on the schema authoring surfaces: the User Attributes table chips and the Ranked schema modal. They are not shown in the Membership Policy editor's Values column, in user profile views, in denial messages, or in directory entries. The audit log retains rank and schema version for decision reconstruction.

4.5 UAS-sourced schemas (read-only)

When a ranked schema is mirrored from an external User Authoritative Source, all edit affordances on the User Attributes page and inside the Ranked schema modal are disabled. A provenance ribbon at the top of the modal shows the source connector name, last sync time, and last-known-good timestamp. There is no proactive "stale data" banner — stale data fails secure at policy evaluation; admins discover staleness via denials and the audit log.

4.6 Direction conventions

Two opposite ordering directions are used in this feature, by design:

• Vertical lists (the Ranked schema modal rows, the Clearance picker menu) — top of list is highest rank.

• Horizontal chip rows (the Values cell on the User Attributes table) — left to right is ascending rank, so the highest rank sits at the right end and new values append on the right.

5. States

For each new surface, the following states need design and review coverage. Existing states for Custom Profile Attributes (empty schema, network error, save in flight, etc.) are unchanged.

6. Accessibility

Per-chip popover focus model. Tab moves through the popover's fields; arrow keys cycle chips inside the Values cell. Pressing Enter on a chip opens the popover. Esc closes and returns focus to the originating chip. While the popover is open, focus is trapped inside and the row's overflow menu cannot be activated.

7. Compliance

DoDM 5200.01 is compatible with this design but does not prescribe label-namespace visibility behavior. The visibility rule in §4.1 is grounded in NIST controls, not in DoD doctrine.

8. Edge cases to validate

• Rename mid-edit. Admin renames Top Secret → TS while a Channel Admin has the policy editor open on a policy referencing the old label. The policy stores a value ID, not the label string, so the policy continues to work and renders the new label on next open. No data loss; no UI banner.

• Re-tier of a schema. Admin inserts a new option between two existing tiers, shifting integer assignments. The visibility rule re-applies on next session; treat re-tiering as a schema-version bump in the audit log.

• Autocomplete oracle on Shared-only surfaces. On a peer-to-peer surface with a Shared-only ranked attribute, client-side autocomplete on a search/mention input must not reveal the existence of values the viewer doesn't share with the subject through differential latency or completion behavior. The server returns only the collapsed min() value; the client never receives above-viewer values.

• Count-based inference on Shared-only profile cards. A profile card or hover preview must not show "showing 3 of N" totals that would leak the higher-tier population size. Suppress totals on Shared-only surfaces whenever the viewer's rank is below the schema maximum.

• Drag interrupted by focus loss. Mid-drag focus leaves the browser. The drag cancels cleanly and the row returns to its origin; no partial reorder, no transient duplicate-rank state.

• Partial UAS sync. A push delivers child values before the parent. Server-side atomic sync rejects the partial transaction; the UI never renders an orphan state.

• No "view dependents" navigation today. When a delete affordance is disabled because of policy references, the tooltip names the count but offers no link to the dependent policies. Admin discovers them by searching the policy list. A future enhancement.

9. Open items

• Ties. v1.0 enforces unique ranks. If a customer surfaces a real need for tied ranks later, the unique-rank rule reopens and the per-chip popover gains a free integer input.

• Color customization on ranked options — likely v1.1.

• Rank visibility in the Membership Policy editor value picker — deferred until a customer asks. Surfacing rank inside the policy editor leaks ordering information to scoped admins who may not need it.

• Hierarchical (tree-structured) attributes — follow-on release. Composition with the Shared-only access mode (does "min rank" intersect with "shared ancestor in the tree"?) needs an explicit decision before that work begins.

• "View dependents" navigation from a disabled delete. Tooltip names the count today; future enhancement could link to the list of dependent policies.

10. Glossary