- Shipped
- August 22, 2026 at 2:11 AM UTC
- Author
- Kamo
- Commit
- 277dabc
Unread mail hangs off ACCESS_MAIL and leads-needing-action off VIEW_LEADS, both by the same rule as the calendar widgets: a widget is gated by the right that governs the data it shows, so granting the widget can never be a way round that gate. TIMECARD_TODAY_WIDGET is the exception, and it is a deliberate one. A member's own punches are not modelled as a right anywhere in this platform — enrollment is a persisted employment fact precisely because a right would leak ON through a grant-all role, god mode and the child-org template, and would vanish from a terminated member exactly when HR must produce their final timecard. The gate on that data is therefore stronger than a right, not missing, and the widget honours it before it renders. Rather than force a wrong parent or quietly delete the invariant, the test now takes a NAMED allowlist with the reason attached. Totals move to 218/155/33/30 and 63 roots.