- Shipped
- November 14, 2026 at 8:09 PM UTC
- Author
- Kamo
- Commit
- b5684db
- MlosModuleStateInterceptor (after the app/right gates, /api/security/mlos/**): a CHANGE the org's business type rules out is refused with a plain 403 before it is relayed — catalog authoring vs rate-sheet price data (a broker ingests its lenders' sheets but authors no guidelines), selling loans **************** refused for a portfolio lender), capital markets for a broker or servicer, AUS waivers at a pre-check depth, underwriting/pricing for a servicer, servicing actions for an oversight-only lender. Reads always pass. - Provider-connection save: a new connection, or an edit that leaves one on, for a vendor kind the business type never uses is a field-level 400 {code MLOS_KIND_NOT_USED, field vendorCategory, error: <plain sentence>}; an existing one can still be switched off or removed. - GET **************** business type + module and queue states + the vendor kinds it uses, readable by any signed-in member (the steward console hides HIDDEN queues and shows READONLY ones View Only). - integrations-status gains allowed (does the business type use this kind) — a broker's closing documents never read "not connected yet"; credit orders and the borrower quote answer NOT_USED with the plain reason.