- Shipped
- August 14, 2026 at 9:48 PM UTC
- Author
- kamo
- Commit
- 0f964dd
The audit's gate detection recognised hasRight and checkRight but not denyUnless, hasAnyRight, sessionHasRight or forbidden. Six rights that ARE enforced were therefore listed as gating nothing, and the editors were rendering 'Not yet enforced' against them: VIEW_ACCOUNTS, CREATE_ACCOUNTS, EDIT_ACCOUNTS, DELETE_ACCOUNTS, VIEW_DASHBOARD and MANAGE_ORG_BRANDING. AccountController gates all four account rights through denyUnless(request, RoleRightType.VIEW_ACCOUNTS). Telling an administrator a live permission does nothing is worse than saying nothing at all — it invites granting it carelessly, or deleting it. The helper list is now DERIVED from the codebase instead of guessed, and the command to re-derive it is in the file so the next regeneration cannot repeat the mistake. Also records the triage result: none of the remaining 52 is vestigial. Each has a real feature surface that the platform gates coarsely, so deleting them destroys live configuration and adding gates removes access from everyone not already holding the right. Both are seeded migrations, not cleanups; §9 lists them in recommended order.