- Shipped
- October 28, 2026 at 2:57 AM UTC
- Author
- Kamo
- Commit
- 7e027cc
The Administrator (Full Access) role is stored isAllowEditSecurity=false, so no one could change its rights. **************** is the one door in: it accepts only the org's role_admin_id role and refuses any save (after normalizing the level) that leaves a right in **************** short of GRANTED. That set is CONFIGURE_SYSTEM plus its ancestors: the right that opens Settings > Essential and every role write, so its holders can always come back. SecurityRoleDTO.lockedRights tells the editor which switches are pinned.