Fail-closed tenant guard on underwriting waivers/validations

Shipped

July 2, 2026 at 11:12 PM UTC

Author

Kamo

Commit

1be94f2

Review found the org guard was a no-op on the common empty-list case for the by-id waivers/validations reads (which the MLOS service does not org-filter), leaking cross-org run existence + finding UUID. Now verify run ownership via the org-bearing detail read before serving, and fail closed on any unconfirmable 2xx shape. Same fail-closed hardening applied to the capital-markets by-id guard. Also: service-agnostic upstream-error message; god-eligible (not active) wording.