- Shipped
- October 14, 2026 at 1:41 PM UTC
- Author
- Kamo
- Commit
- cc6639e
Branch types, the security models behind them (default security roles, app availability, home screens, commerce markets, subdomain config) and the master model used to be editable by any organization from its own Settings -> Account. The owner wants only the platform organization to set them. So these endpoints now require the new MANAGE_BRANCH_TYPES platform right: - SecurityModelController and SecurityModelMarketController, whole class - MasterModelController, whole class - BranchTypeController's /{id}/usages PlatformRightsResolver answers nothing inside a tenant, so this closes them to every organization but the platform's with no second check. BranchTypeController's list and /creatable stay open, because the org-creation wizard reads them. A tenant's existing models keep governing its child orgs; they just can't be edited from the tenant any more. Needs kamo-shared-library 0542057b (MANAGE_BRANCH_TYPES).