- Shipped
- September 23, 2026 at 11:26 AM UTC
- Author
- Kamo
- Commit
- 8685623
**************** and **************** had no authorization check at all — any member of the organization, not only its owner, could move the whole organization's mail or phone costs onto or off a billing group by calling PUT **************** or PUT **************** Both methods' own javadoc already said this was not a member-level decision; nothing enforced it, unlike OrgBillingPolicyController's equivalent PUT, which does. Both now take X-Member-Id (as every other owner-gated billing endpoint does) and refuse with 403 via **************** orgId) — the same check, and the same service, OrgBillingPolicyController already uses for the org-wide delegation setting these two group-level cost modes sit beside.