- Shipped
- October 18, 2026 at 6:43 PM UTC
- Author
- Kamo
- Commit
- 297aad2
MANAGE_ANALYTICS: Analytics signed every caller in as one shared analytics administrator, so VIEW_ANALYTICS let anyone create, edit and delete every tracked website, link and pixel. Members now sign in as themselves; VIEW reads, MANAGE changes. A child of VIEW_ANALYTICS, seeded from it by SecurityService so nobody loses what they can do today. VIEW_ORG_BILLING / MANAGE_ORG_BILLING: Plans & Billing showed a member only their own account and the owner everyone's (a flag, not a right). These let the owner give an administrator or an SI read access to the organization's billing accounts, subscriptions, seats and invoices, and the actions on them. Seeded to nobody: the owner keeps the owner path, nobody gains or loses anything until granted. RoleRightHierarchyTest: 402 values, 278 children, 45 roots with children, 79 standalone, 124 roots.