## Problem/Motivation Follow-up to #3586405+s (the `ai_context_scope` formatter). Do not land this on #3586394+s. Specific Entities (Entity Items) are stored on the `entity_items` field, not the scope field. Several display paths printed those entities with `toLink()` / `label()` / `getSelectedValueLabels()` and no `access('view')` check. Anyone who can view the context item could see titles and canonical URLs of entities they cannot view. The same render paths also dropped or reconstructed cache metadata: - The formatter can add each entity and its view-access result. - The canonical Details panel was inventing `user.permissions` plus `{type}:{id}` tags, which misses grants, custom access handlers, and max-age. - Context Tags used hardcoded `taxonomy_term:{id}` tags instead of a selected-term cacheable-label path. - Admin summaries (item form, subscription summary, agent-form Scope column) called `getSelectedValueLabels()` and never collected cacheability. A second bug on the view path: the Specific Entities heading was built only while the scope field formatter ran. An item that has `entity_items` and an empty scope field never showed that section. ## Proposed resolution **Access** - Skip referenced entities the current user cannot `access('view')`. - Add each entity and its view-access result as cacheable dependencies. - Hide the Specific Entities section when every entity is denied, but keep the access cacheability. - Still render Specific Entities when `entity_items` has values and the scope field is empty. - Leftover display helpers `getEntityItemData()` and `buildEntityItemRenderArray()` use the same omit + bubble contract and are marked `@internal`. **Cacheable labels** Use `getSelectedValueLabelsWithCacheability()` wherever selected scope labels are shown and a collector is available: - Details panel (Specific Entities, Context Tags, and Taxonomy Terms). - Context item listing (already used this API). - Item-form stored-scope summary, subscription summary, and the agent-form Scope column. Specific Entities, Context Tags, and Taxonomy load only selected values for **labels**. `addScopeViewCacheMetadata()` keeps plugin config tags plus `languages:language_interface`. Term tags and entity-access metadata come from the label path. Full-view preprocess computes Details rows and the empty-state section in one pass. The `@internal` builders stay stateless (no object-id memo). **Not changed on this issue** - Context Tags still calls `getValues()` when collecting alter-hook cache metadata. That is a vocab-wide load. Labels already use `loadMultiple($selected)`. The `ai_context_tags` vocabulary is expected to stay small (about 0–50 terms), so this stays as-is. A follow-up can skip `getValuesCacheableMetadata()` if a site outgrows that. - Denied Specific Entities are omitted (no `@type:@id (no access)` placeholder) on Details, listing, formatter, and admin summaries. Usage UI still uses `(no access)` for a different job. ## Remaining tasks - [x] Check `view` access before showing each referenced entity (formatter + `getSelectedValueLabels()`) - [x] Show Specific Entities on entity-only items - [x] Details panel uses `getSelectedValueLabelsWithCacheability()` instead of reconstructed cache tags - [x] Context Tags cacheable-label path (selected terms only); drop hardcoded `taxonomy_term:{id}` in `addScopeViewCacheMetadata()` - [x] Admin summaries (item form, subscriptions, agent form) use the cacheable-label path - [x] Kernel tests: denied access, empty-scope + `entity_items`, Details-panel access bubbling, Tag/Taxonomy term tags from scope rows, summary omit/bubble - [x] Re-test the item view, listing, item form, and an agent form after the summary work - [x] Manual Specific Entities check with Dynamic Entity Reference (viewer vs admin; mixed + all-denied; `default` formatter vs canonical `full` Details) ## Out of scope - N+1 label loading. `referencedEntities()` / `loadMultiple()` already multi-load. - Term `access('view')` on Context Tags. Tag cache tags are label invalidation only. - Custom scope plugins that implement `getAlteredValues()` without cache metadata. Track that on #3586419+s if it needs work. - All-denied item-form summaries returning an empty render array with no `#cache`. The agent-form empty `—` cell does keep the collector. ## AI disclosure - [x] AI assisted issue