- Shipped
- November 13, 2026 at 12:26 AM UTC
- Author
- Kamo
- Commit
- 25e0e22
Owner's rule, applied on every SecurityService path through the shared MemberSecurityLevelPolicy (kamo-shared-library 3a838c2e): - PATCH **************** moves the level with the type **************** member -> team member raises a level below Team Member to Team Member; team member -> member sets Member, even from a raised level. The answer now carries securityLevel/securityLevelId, the audit line says how the level moved, and a moved level announces SECURITY_LEVEL to the org graph. - PATCH /member-security/{id}/access refuses a level the member's type cannot hold with a 400 {error, reason} before anything (owner status included) is written. An echo of the level already held is not judged. - Member creation (single, bulk, SI hire) refuses a level the new member's type cannot hold, before the user is written; absent means the type's own level. - SI configure proposals refuse a level below Team Member (an SI is always one). - The System User backfill promotes through changeMemberType too.