A scheduled report reaches a colleague who signs in on another domain (SITP TP16 live smoke)
reports_schedule judged a colleague by the organization's mail domains alone, so in sp00verify the owner's own sign-in address was refused as an outsider. A rec...
Mirror the SITP TP02 rights (440-442) and their parents
MANAGE_ANALYTICS under VIEW_ANALYTICS (Analytics changes, now that each member signs in as themselves), and VIEW_ORG_BILLING with MANAGE_ORG_BILLING under it (o...
Quotes, service work, orders, the commerce pipeline and catalog, subscriptions and reserved opportunities for SIs (SITP TP17)
86 tools over SecurityService as the SI member, each right checked there as well as here: - quotes_*: find, read (share links never carry their address), create...
HR reads a member's leave balances, as it already spends and corrects them (SITP TP18)
GET **************** own on identity (as /me/accruals), anyone else's with MANAGE_TIMECARDS, the right that already gates /use and /adjust on the same balances;...
Subscription records, market lists and order notes reach only the caller's organization (SITP TP17)
SubscriptionService reads a subscription, its order, invoice and agreement by uid alone, in any tenant. POSController now checks the record is the session organ...
Rights-carrying doors to commerce invoices and billing, and the MANAGE_ANALYTICS backfill (SITP TP02)
Commerce invoices: InvoicingService's CommerceInvoiceController checks no right by design (it expects SecurityService to own the session and the rights) and not...
Binders_create sends what CreateBinderRequest reads; scripts_create names a market by its leads_list_markets id (SITP TP14 live smoke)
DocsService refused every binders_create: CreateBinderRequest's primitive isTemplate binds as "template", so the body's isTemplate was an unknown field (400). A...
The tool lists gain exactly SITP TP16's 30 tools and reports_run's page
Snapshots regenerated (-Dtoolplane.parity.write / -Dtoolplane.golden.write) on top of TP14: the only changed entry is reports_run (page, and its description); e...
Billing accounts answer to VIEW_ORG_BILLING / MANAGE_ORG_BILLING, and the listing shows a member only their own (SITP TP02)
BillingService authorized 'own account or organization owner' and never consulted a right, so the owner could not hand billing to an administrator or an SI. Acc...
Report options, export, paging and schedules; rights explained; org structure; settings screens by their rights (SITP TP16)
30 new SI tools, each asking the right the screen's endpoint checks (rights enforced twice): - reports_options (a picker's live choices), reports_run pages thro...
SITP TP02 rights — MANAGE_ANALYTICS (440), VIEW_ORG_BILLING (441), MANAGE_ORG_BILLING (442)
MANAGE_ANALYTICS: Analytics signed every caller in as one shared analytics administrator, so VIEW_ANALYTICS let anyone create, edit and delete every tracked web...
State licences are read and replaced only within the caller's organization (SITP TP16)
GET/PUT **************** found the member by id alone, so a holder of STATE_LICENSING_VIEW_ALL / EDIT_ALL in one organization could read, replace or delete anot...
Documents, KB writing and review, careers screening, checklists, sales scripts and binders for SIs (SITP TP14)
84 tools and docs_search filters, so an SI can do in Docs, the knowledge base, HR careers, checklists, sales scripts and binders what a person does, within its ...
Email templates and the org calendar/contacts connection take MANAGE_EMAIL_SETTINGS (SITP TP02)
EmailTemplateController and EmailTemplateCategoryController checked a session alone: any member could list, read, preview, create, edit, archive, duplicate or r...
An RSVP from a member with no mailbox says so (409 NO_MAILBOX), not a bare 400 (SITP TP12 live smoke)
KamoLOS checks the PLOS right and the organization on every route, and opens a one-time-key door (SITP TP02)
KamoLOS enforced no right: kamo-internal's /api/los proxy was the only gate. LosRightsFilter now applies the proxy's own requiredRight() table (LosRights) to ev...
The Interaction Center and the hexheads stand aside for a guided tour too
Follow-up to 2363d832, which cleared the dock windows. Two more surfaces could still sit in the spotlight: - The Interaction Center. A tour step (Online Meetin...
Sending for signature takes EDIT_DOCUMENTS and reading a template takes VIEW_DOCUMENTS (SITP TP02)
POST /api/esig/envelopes (create and send) checked no right, so any org session could send any template out for signature; it now takes EDIT_DOCUMENTS, the righ...
Chat_send_file posts a text document DocsService typed octet-stream as text/plain (SITP TP13)
DocsService records Markdown, YAML, logs and other text without an ImageMimeType as application/octet-stream, which chat's attachment allow-list refuses. A docu...
StrictReadTest expects a withheld SI card to be passed on as the DM it learned from
Since c13c47b (ruling CP07-T43-1/-7) a withheld record no person owns or takes part in stands in the withheld store for its inherited sources the audience may n...
Review steps stay in the caller's organization; pins take VIEW_KB_ARTICLES (SITP TP14)
submit-review, approve and reject named an article by guid alone, so a member holding CREATE_/REVIEW_KB_ARTICLES in one organization could move another organiza...
Binders and the share lists take VIEW_DOCUMENTS (SITP TP14)
Every BinderController route (list, get, create, scratch, update, duplicate, delete, items, reorder, shares, render) took a session alone, so a member without V...
The tool lists gain exactly SITP TP12's 25 tools, calendarId and the IoT/RPM notification kinds
Snapshots regenerated (-Dtoolplane.parity.write / -Dtoolplane.golden.write): the only changed entries are calendar_create_event (calendarId) and notifications_l...
Webinar booking checks its rights and the type's organisation; an SI brings SIs into its own meetings (SITP TP12)
Owner decision 5 (security gaps fixed with the tools that use them): - /api/webinar: booking (available types, bookable times, a type's sessions, schedule, join...
/imaging/download answers its bytes again instead of 500 (SITP TP13)
Since d1a8762 the download body was a StreamingResponseBody inside the method's ResponseEntity<?>. Spring hands a StreamingResponseBody to its streaming handler...
An event names its organiser; an RSVP that cannot be taken says why (SITP TP12)
- EventDto carries organizerEmail, so the Tool Plane's calendar_rsvp names who the answer is mailed to (and classifies an outside organiser as an external mee...
An SI records or withdraws a lead's call consent (SITP TP11)
leads_record_voice_consent and leads_withdraw_voice_consent over SecurityService's PUT/DELETE /leads/{id}/ai-voice-consent (authorized there like editing the le...
Meetings history and transcripts, calendar answers, presence, notification dismiss/snooze, webinars (SITP TP12)
25 new SI tools, each checked by the same rights at the gateway and at the owning service: - meetings_history, meetings_get, meetings_get_transcript (MEETING, p...
Lead callbacks take MANAGE_LEAD_CALLBACKS, as SecurityService now does (SITP TP10, after TP01)
Files_upload sends the type and digests ConversionService checks (SITP TP13)
ConversionService detects a file's type from its bytes and name and refuses a declared type that differs, then compares the client's Blake3 and SHA3-256 digests...
Files_upload files into My Docs by its ordinal (SITP TP13)
ConversionService refuses an upload whose metadata names no assocType (values()[assocType]), and its own no-metadata default (4) is MEET_RECORDING's ordinal. fi...
Mirror the SITP TP01 rights (410-418) and their parents
MANAGE_PRODUCTS, MANAGE_INVENTORY, MANAGE_RETAIL_CUSTOMERS, MANAGE_FULFILLMENT, MANAGE_RENTALS, MANAGE_PROCUREMENT and APPROVE_PURCHASE_REQUESTS under ACCESS_CO...
Rights on the session-only controllers, with the grant backfill (SITP TP01)
@RequireRight (any-of, tenant RoleRightType) enforced by TenantRightInterceptor before the handler, the tenant counterpart of @RequirePlatformRight: no session ...
SITP TP01 rights for formerly session-only endpoints (410-418)
Nine rights in the TP01 block for endpoints that answered any signed-in member of the organization: - MANAGE_PRODUCTS, MANAGE_INVENTORY, MANAGE_RETAIL_CUSTOMER...
Leads, accounts and communications timelines for SIs (SITP TP10)
54 tools over SecurityService as the SI member, each right checked there as well as here: - leads: create, edit (masked values never written back), assign, bulk...
The quick-insert lists and renders templates through VOIPService's members' door (SITP TP11)
/api/voip/sms/templates is X-Internal-Auth only, so no browser session reached it and the popover always listed nothing. /api/voip/sms/text-templates takes the ...
Shared mailboxes, folders, stars, Trash, labels, attachments in and out, group chats, drips, files_upload, contact groups (SITP TP13)
27 tools and two new arguments, so an SI can work its mail and chat as a person does: - mail: mail_list_folders, mail_flag, mail_delete (to Trash only; a messa...
The phone inbox, the do-not-contact list, contact call consent, text templates and MMS (SITP TP11)
22 new SI tools, each checked by the same rights at the gateway and at VOIPService/EmailService: - phone_list_voicemail, phone_voicemail_mark_read, phone_voicem...
Rights on the lead doors the SI tools use, and the caller's own callbacks due (SITP TP10)
- PUT /leads/{id} takes EDIT_LEADS; a create that assigns someone else takes ASSIGN_LEADS - the lead pool (/leads/available, /leads/accept) takes VIEW_LEADS or ...
One's own text numbers need the Phone tab's rights, not a bare session (SITP TP11)
ACCESS_VOIP, or MANAGE_EXTENSIONS / MANAGE_VOIP_SETTINGS: the rights settings/member opens its Phone tab on, so nobody who sees the card today loses it.
A clinician's direct order never lends an SI the clinical acts
SITP TP00: pins the new SI floor (kamo-shared-library 645068bb) through the No Insubordination delegation: drafting notes, booking and posting payments are lent...
The members' text-template door refuses flat {error, code, reason} (SITP TP11)
The shape every member-facing VOIPService refusal has, so the Tool Plane and the browser read the reason without unwrapping a nested object.
The softphone's own surfaces check ACCESS_VOIP, and members get a session door to text templates (SITP TP11)
- CallController (call history, own voicemail list/read/archive, queues, agent state), missed-calls-seen, the do-not-contact check and SMS send now check ACCE...
Every SI gets the report tools by its rights; config_* gated by rights, not audience
SITP TP00, owner decisions 2026-10-18: - reports_list, reports_run and metrics_get drop CP14's WATCH charter switch: an SI is offered them by VIEW_REPORTS and...
?session= pins an attachment read, an edit, an unsend and a reaction to one conversation (SITP TP13)
The Tool Plane checks a run's audience on the conversation an SI names. A message id or an attachment id alone could reach another conversation the SI also belo...
A shared-mailbox send meets the SI guards; message labels take ?folder= (SITP TP13)
A send as a shared mailbox skipped the checks EmailController#sendEmail runs: an own-domain recipient that is nobody (422 RECIPIENTS_UNKNOWN), the SI thread-tur...
An SI never signs, prescribes, orders, immunizes, breaks the glass, merges charts or bulk-exports patients
SITP TP00, owner decision 2026-10-18: in Patient Records an SI drafts only (and may post payments behind approval). Nine EHR rights join AiRightsFloor.NEVER_GRA...
IoT Devices articles use the product's own words (SP14)
Task 39 audit against origin/main (kamo-internal e20c0af59, KamoMobile, iot-service, kamo-login): the web alarm-rule editor and escalation policies replace the ...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.