- Shipped
- November 15, 2026 at 5:21 AM UTC
- Author
- Kamo
- Commit
- 5c0ba56
GOD RULE (owner 2026-11-14): User.isGod alone, no god-mode window: - PlatformAdminInterceptor: every @PlatformAdminOnly right, any org. - EnterprisePlanGuard: may sell negotiated plans. - GodModeVerifier.isActingAsGod (account/group cross-org scope, storage org override): GD alone; a session on the request must still name the member and carry GD; is_god is re-read from the DB. - Owner gates (billing groups, org billing policy, PBX/mailbox cost mode, seat changes, plan tier) via new **************** the ownership fact (who pays, DTO flags) is unchanged. - StripeGraceService seller gate. Tenant-org passes are audited (GOD ACCESS log); the platform org id is read once and cached **************** Never throws.