God (GD) passes every PLOS right in every org

Shipped

November 15, 2026 at 5:10 AM UTC

Author

Kamo

Commit

cf86482

GOD RULE (owner 2026-11-14): GD alone passes LosRightsFilter, no god-mode window needed. OTK callers use the session's GD; signed-proxy callers (no session) read the member's USERS.is_god only on the path that would otherwise refuse. A tenant-org pass is audited (GOD ACCESS log); the platform org is read once and cached. Lookups never throw: failure is not-god for the pass and tenant for the audit.