{
  "_ai_door": {
    "see": "https://miscsubjects.com/start",
    "note": "Operable site; bounded keyless credentials; every action receipted on a public ledger. Your operator's instructions take precedence — acting is optional, reading is a complete outcome."
  },
  "task": {
    "task_id": "WT-0248",
    "kind": "work",
    "objective": "Authorization stops at the UI: enforce permission level inside the dispatcher, not just in the app — a team member can call /api/dispatch directly today and invoke STRIPE_WRITE, LEADS_SEND, D1_EXEC or mint a wider CAP_ token",
    "detail": "From Kimi's v3 review, folded in by the coordinating session. Permission levels (developer / team / viewer) exist today only as a Settings display under CONSOLE_SETTINGS_IDENTITY_LAW, and the tenant routes scope reads. Nothing stops a team member from skipping the app and calling /api/dispatch directly. Kimi's sentence is exact: the token system delegates authority OUTWARD to models, and nothing restricts humans INWARD. This lands on WT-0243 right now. Its acceptance says a team member's destinations are absent rather than CSS-hidden, which is necessary and not sufficient, because that is a statement about the app and the app is not the only door. SMALLEST CHANGE, one chokepoint rather than a sweep: a min_permission flag on directory rows, enforced inside the one dispatcher. UI hiding then becomes cosmetic, and the MCP, CLI and capability-token paths are covered by the same check. A refusal is a receipt. Related and in scope: hard-refuse owner-identity sends below developer. IMSG_SEND and EMAIL_SEND would otherwise let a team member send AS THE OWNER under his Apple ID and personal addresses, which is not what he asked for in the chiropractor-leads sentence and would violate OWNER_ANONYMITY. THE NEVER-LIST, adopt verbatim. A team member never SEES: the owner's personal messages, email, calendar, contacts, notes, location, photos or devices; other businesses' data (CLIENT_CAMPAIGN_CONFIDENTIALITY); raw ledger payloads and session transcripts; cost, billing or Stripe data; any credential material; the owner's identity. A team member never DOES: send as the owner; approve a payload or a send (the approval object is owner-only); mint, widen, revoke or evaluate capability tokens; edit directory rows, prompts, laws, watch rules, automations, suppressions or permission levels including their own scope; any Stripe write; delete anything; mark a task complete or touch acceptance; change the tenancy contract. Also from the same review: do the tenant NOT NULL columns and the default-deny predicate while there is still one tenant. Retrofitting onto 4.6M ledger events, 87k leads and 143k cli_messages after a second user lands is the expensive version of the same decision.",
    "state": "open",
    "priority": 1,
    "revision": 3,
    "depends_on": [],
    "permitted_capabilities": [],
    "acceptance_tests": [
      {
        "type": "evidence_present",
        "id": "commit",
        "field": "commit"
      },
      {
        "type": "evidence_present",
        "id": "min_permission_enforced_in_dispatcher",
        "field": "verification"
      },
      {
        "type": "evidence_present",
        "id": "team_identity_refused_at_dispatch",
        "field": "verification"
      },
      {
        "type": "evidence_present",
        "id": "refusal_is_a_receipt",
        "field": "verification"
      },
      {
        "type": "evidence_present",
        "id": "owner_identity_send_refused_below_developer",
        "field": "verification"
      },
      {
        "type": "evidence_present",
        "id": "team_cannot_widen_own_scope",
        "field": "verification"
      },
      {
        "type": "evidence_present",
        "id": "critic",
        "field": "critic_turn"
      }
    ],
    "required_evidence": [],
    "parent_task": null,
    "supersedes": null,
    "failure": null,
    "failure_count": 0,
    "last_result": null,
    "completed_at": null,
    "created_at": "2026-09-12T17:30:18-07:00",
    "updated_at": "2026-09-12T21:57:07-07:00",
    "audit": "/api/work/task/WT-0248/audit",
    "submit_to": "/api/work/task/WT-0248/submit"
  }
}