Gate the nine Service Work endpoints on a right

Shipped

August 26, 2026 at 5:17 AM UTC

Author

Kamo

Commit

5b08c93

They shipped checking only that the caller had a session, so any member of an org could read and mutate every work order in it regardless of role. ASSIGN_SERVICE_WORK and COMPLETE_SERVICE_WORK are added by SW1 but gate nothing yet — the endpoints they belong to arrive with the domain core in SW3. They ship now so the hierarchy and the permission editors are complete in one change.