FR: producer-side access control for shared metadata collections (private/protected/public)

[dmealing]

Gap

MetaObjects has consumer-side scoping (what I choose to load/emit) but no producer-side access control (what a consumer is permitted to depend on). Everything in a metadata collection is visible to everyone who loads it.

This becomes load-bearing as soon as a shared model is consumed across teams: the first question a platform team asks when publishing a shared collection is "how do I keep the internals internal," and today the answer is "you can't."

The two are not substitutes. Consumer scope is advisory — narrowing it is my choice. Access is a contract the producer enforces.

Prior art (open source)

• dbt — three access levels on a model: private (its group only), protected (the project/package; the default, for backward compatibility), public (referenceable across projects). Paired with groups that carry an owner. https://docs.getdbt.com/docs/mesh/govern/about-model-governance
• Smithy — an @internal trait plus a build transform that strips internal shapes from what external consumers see. https://smithy.io/2.0/guides/smithy-build-json.html

Notes

• Needs ADR-0037's vocabulary decision procedure run on it (attribute vs subtype vs derivable).
• Registry addition ⇒ MINOR under ADR-0035 Amendment 1.
• Default must be backward-compatible: an existing collection with no access declarations behaves exactly as today.
• Interacts with package-source resolution: enforcement is most meaningful at a collection boundary, so this is naturally sequenced after package sources land.

Deferred from the metadata source resolution design (docs/superpowers/specs/2026-08-17-metadata-source-resolution-design.md), which is config-only and does not preclude this.