- Shipped
- September 25, 2026 at 7:35 PM UTC
- Author
- Kamo
- Commit
- 4871743
The second door to IMPORTANT-1 of the SP02 final review. POST /api/security/organizations needs no right for a standalone organization: any signed-in user may create one, becomes its owner through a new (HUMAN) membership and is handed a session into it. For an AI's user that is an owner session outside the never-grantable floor, the supervisor ceiling and the kill switch. createOrganization now answers 403 {reason: AI_CANNOT_CREATE_ORG} when the caller's user holds an ARTIFICIAL membership (an AI's user holds exactly one), before the velocity cap or any write. The membership decides, not the session label, so an administrator impersonating the AI is refused too. People, including a brand-new sign-up with no membership yet, are unchanged.