- Shipped
- October 18, 2026 at 7:59 PM UTC
- Author
- Kamo
- Commit
- 2533b2d
The envelope door already hid an envelope whose template sits above the session's clearance and an EMPLOYMENT_OFFER envelope from a member without an HR right, but the template door and the send did not apply the same ceilings: any VIEW_DOCUMENTS holder could read every template's signer slots (pinned names and addresses) and design, and any EDIT_DOCUMENTS holder could send a template filed above their clearance or an employment offer. - Template reads (list, by document, the template, its signers, its design and versions) answer only templates at or below the session's clearance; one above it is 404, as an envelope above it is. - The staff send (POST /api/esig/envelopes) takes the same clearance and, for EMPLOYMENT_OFFER, an HR right; the internal API's send is unchanged. The Tool Plane's e-sign tools (SITP TP19) use these doors as the SI member.