- Ya
- 15 Agosti 2026, 05:54 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 06823d9
PUT /org/{id} derived the age ranges and the three ATF flags from the stored row whenever a request omitted them, then asserted all five against the applied security model. Every branding save omits all five, so the endpoint was re-auditing data the caller had not mentioned. For an org whose stored values disagree with its model that meant nothing could be saved at all. KamoCRM Inc. has **************** true under an all-NOT_ALLOWED master model, so a save of Background Watermark, the brand-identity selectors or the new home page logo overlay came back 403 "Alcohol-related content is not permitted by the applied security model" — an error about a subject the request never touched, and one no amount of correct branding input could get past. Now each check sees null for a field this request does not carry, and skips it. Setting a forbidden value is still refused; only the untouched fields stop being judged. This is how the isPrivate gate three lines below has always worked — these two had simply never been given the same treatment. The create path still judges all three flags, which is where the model's compliance policies were always meant to bite. The stored violation on that org is untouched and remains a real question for whoever owns its compliance settings.