feat(permission-groups): declare capabilities on the operations staging added

The merge brought three new operations, which the required capability field
and the enforcement audit both refused until answered: files.search_content
takes files.use like every sibling; the paused-execution read is exempt (its
detail is pause points and resume state, never the fields logs.cost or
logs.trace_spans withhold); SSO JIT admission runs before any membership
exists, so no group can govern it yet.

Author: waleedlatif1

apps/sim/lib/auth/sso/application/operations.ts

@@ -5,7 +5,9 @@ import { defineOperation } from '@/lib/core/application/operation'
  * exists. Workspace-role authorization cannot apply yet; the use case instead
  * proves the exact provider link, verified domain, and provider-bound target.
  */
+// permission-group-exempt: SSO admission runs before any organization membership exists, so no group can govern the identity being admitted yet
 export const ssoJitAdmissionOperation = defineOperation({
   id: 'sso.jit-admit',
   principalKinds: ['session'] as const,
+  capability: 'none',
 })

apps/sim/lib/workflows/application/operations.ts

@@ -440,10 +440,12 @@ export const workflowOperations = {
     capability: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
+  // permission-group-exempt: a paused execution's detail is pause points and resume state, not the run's execution data — the fields logs.cost and logs.trace_spans withhold never appear here
   readPausedExecution: defineWorkspaceOperation({
     id: 'workflows.paused_executions.read',
     minimumRole: 'read',
     workspaceApiKey: 'allow',
+    capability: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   /**

apps/sim/lib/workspace-files/application/operations.ts

@@ -42,6 +42,7 @@ export const fileOperations = {
     id: 'files.search_content',
     minimumRole: 'read',
     workspaceApiKey: 'allow',
+    capability: 'files.use',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   download: defineWorkspaceOperation({