## Problem/motivation Some context items only make sense for certain audiences. For example, editorial guidance is only useful to users with an editor role. Today every enabled context item is a candidate for every user, with no way to say "this item is only for people with these roles." Every existing scope answers "what is being worked on" (entity type, term, section, language). None answers "who is doing the work." Roles is the missing dimension. Note this is different from the existing Specific Entities (Entity Item) scope: that matches the entity being worked on (e.g. a context item fires when someone views/edits user X's profile). This issue is about the acting account — who is running the AI interaction — regardless of what content is being worked on. Example scenarios: - Editorial house-style rules and basic authoring help both apply to the same entity types, sections, and terms. Only the role dimension separates the audiences. - Internal guidance (moderation criteria, pricing rules) should inform AI assistance for staff roles but never be injected into an interaction driven by an ordinary authenticated user. Today there is no lever to prevent this. - Combined with other scopes: "in the /reports section, editors get the data-verification checklist; marketing gets the brand-language guide" — section alone cannot split the audiences. ## Proposed resolution Add a **Roles** scope plugin (machine ID `roles`) that lets a context item be limited to one or more roles. "Roles" matches core's own label (the Roles page under People, the Roles block-visibility condition). The scope description should clarify these are Drupal user roles, not LLM message roles (system/user/assistant). ### Behavior - When the item has no roles selected, the scope does not apply and the item is unaffected (consistent with other scopes). - When non-empty, it is a **hard filter**: the item is only available if the acting account has at least one of the selected roles. - Fail closed: if the acting account cannot be determined, an item with role values is excluded. - Relationship to #3586394 (selection-mode ladder): situational auto-inclusion is an explicit list there, which this scope is not part of. To stay mode-agnostic, `matchesCurrentContext()` returns NULL when the user is allowed and FALSE when not — never TRUE — so an item can never be auto-included merely because the user is permitted to receive it. No API change needed. ### Form/UX - Role checkboxes from the role list (dynamic values, like the Language scope), with a manage link to /admin/people/roles. - `supportsSubscriptions()` = FALSE: agents subscribe to topics, not to the current user's roles. ## Decisions to confirm 1. Which account is checked: the interactive current user vs. the account an AI run executes for (cron/queue runs may execute as anonymous or a system account). Proposal: current user for now, with delegated-account support as a follow-up if needed. 2. Whether the "authenticated user" and "anonymous user" roles are offered as values. ## Remaining tasks - Implement the plugin, settings form, and value storage. - Handle deleted roles (stale values simply never match). - Cache considerations: selection now varies by role — verify cache contexts (user.roles) on affected paths and the scope prefilter/index. - Kernel tests for matching (single/multiple roles, no roles, anonymous, fail-closed) and functional test for the item form. - Documentation, including an explicit note that this is not a security/access-control boundary for viewing or editing the item — it only controls whose AI interactions can receive the item. ## UI changes New Roles scope section on the context item form (role checkboxes) and a new scope settings/overview entry. ## API changes New scope plugin only. No changes to existing APIs. ## Data model changes New values in the scope map. No changes to existing data. ## Follow-up candidates - Targeting specific users directly (autocomplete). Deferred: the role-based pattern (create a role, assign it) covers this today, and direct user targeting adds autocomplete, storage, and privacy complexity. ## AI disclosure - [x] AI assisted issue