Only an open god-mode window bypasses a tenant right, never GD alone

Shipped: September 28, 2026 at 7:08 PM UTC
Author: Kamo
Commit: 14d9a78

Every EmailService rights check let a session with GD through ("GD passes everything"), but GD is god-mode ELIGIBILITY, permanently true for the operators who hold it; only an open window may bypass a check (house rule; SP99 T1 concern 2, carried by the final review). SessionRights.godModeOpen is now the one reader: GD and godModeActive with an unexpired godModeExpiresAt (SecurityService's GodModeSession stamp), the rule CalendarSession.isGod already applied, which now delegates to it. It replaces the GD-alone read in SessionRights.has, AudienceScope and the controllers' own hasRight/denyUnless copies. NoReplyOutboundController keeps its deliberate god-eligibility gate.

All changes

Like what you see shipping?

All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.

Start Free Forever View Pricing