- Shipped
- October 28, 2026 at 5:32 AM UTC
- Author
- Kamo
- Commit
- ef904f6
MLOS endpoints now tell apart members who see all of the organization's loans (View Mortgage Pipeline, or god mode) from members who hold only View Own Mortgage Loans. Own-loan members see and work only loans whose deal names them as assigned loan officer; another officer's loan is 403. Lists (applications, transactions, pipeline, QC queue, legacy POS) are narrowed to their loans. Writes need ownership unless the caller sees all loans. Loan-officer reassignment, HMDA, QC training export/accuracy, webhooks and marketing stay all-loans. An own-loan member who creates a deal with no officer is assigned to it. Borrower (party) access is unchanged. MortgageLoanOwnership answers each check with one scalar, org-bounded query, cached per request, and fails closed when absent. Rights sync seeds View Own Mortgage Loans from the existing mortgage rights (so nobody loses access) and grants it once to every organization's Team Members role; security model templates do the same for the team member template. Administrator roles are grant-all and keep all loans.