- Shipped
- September 4, 2026 at 9:22 PM UTC
- Author
- Kamo
- Commit
- a5b783a
The System User is god by construction, so every session minted for it carries GD and offers break glass. That is fine only because the identity does not compose — and it did. EnterAsController checked for it on one branch of two. SystemUserEntryPolicy refuses to mint a second System User session, but it is consulted only when asSystemMember is set. The ordinary branch asks a weaker question — does this membership belong to the caller's user — which the System User satisfies in every tenant, because the backfill gives it an ACTIVE membership in all of them. So one granted entry into one organization was a key to all the others: hop plainly from tenant to tenant, never passing the policy again, carrying GD into each new session. It also escaped support-ticket scoping. A ticket-scoped grant is registered for revocation only when systemAccess.isTicketScoped(), which is false on the ordinary branch, so hops made from a ticket-scoped session outlived the ticket that justified the first one and SupportSystemSessionRevoker never learned they existed. The platform organization was out of reach only because SystemUserBackfillService skips the top-level org, leaving the System User no membership there to enter on. That is a data fact, not a rule, and it was the only thing between a non-god operator holding SYSTEM_USER and a god-eligible session inside the org that operates the platform. One rule at the door, before the branch, so it covers both: a System User session may not enter anywhere. Enter a tenant as the System User; to go elsewhere, return to your own session and be authorised afresh. EnterAsSystemUserChainTest pins it — three of its five cases failed against the old code, and the negatives assert no *** was minted rather than only the status code. PlatformRightsSystemUserTest pins the other half of the defence: PlatformRightsService already denied platform rights to a System User session, which is what keeps it off /api/security/impersonate/org and the rest of the platform surface, but nothing held that rule in place.