- Shipped
- October 18, 2026 at 6:05 PM UTC
- Author
- Kamo
- Commit
- 172c332
submit-review, approve and reject named an article by guid alone, so a member holding CREATE_/REVIEW_KB_ARTICLES in one organization could move another organization's article through review, and an approval publishes it into that organization's RAG. The article must now be the caller's organization's (another organization's guid is the same 404 as a guid that names nothing); a step that does not apply to the article's status is 409 and a missing review 404, where both were a 500. GET /api/kb/pins lists articles, so it takes VIEW_KB_ARTICLES like every other article list (unpin stays session-only on purpose). The review queue names each entry's article by its row id too (articleUid, a string), the id the Tool Plane labels a KB_ARTICLE by.