- Shipped
- September 25, 2026 at 7:15 PM UTC
- Author
- Kamo
- Commit
- ad5285f
Closes the SP02 final review's IMPORTANT-2. POST /api/security/models, PUT and DELETE /api/security/models/{id} and PUT /api/security/master-model only resolved the caller's organization, so any member session (an AI's own included) could lift the FORCE_NUKEs on the ARTIFICIAL (AI Member) template that bounds it, or FORCE_GRANT rights into the DEFAULT and TEAM_MEMBER templates for every person in the org. All four now follow **************** ladder: 401 without a session, 403 {reason: MISSING_RIGHT} without CONFIGURE_SYSTEM or an open god window (new ConfigureSystemGate), then the org scope. DELETE also gains the org scope it never had (403 for another org's model, 404 for a missing one). CONFIGURE_SYSTEM is on the AI floor, so an AI session can never pass. Every kamo-internal caller sits on a page already gated on CONFIGURE_SYSTEM (settings/essential, settings/account branch-types); kamo-register and the other front ends have none. createModel now resolves the caller, so it leaves the unguarded-endpoint baseline.