Permissions that hold

Every route, every write affordance and every agent tool now checks the same organization role.

access

Roles are only worth having if everything honours them. Permissions are now resolved per request from the member's role in the organization, and every app route requires one, including the tools Agent calls on your behalf. Buttons you cannot use no longer appear and then fail; they are not offered.

View Only is assignable, and role assignment itself is guarded, so a member cannot quietly grant themselves more than they were given.

Improvements
  • Software providers mirror into the asset inventory. A vendor you already track as a provider shows up as an asset without being entered twice.
  • Assessments gained bulk status actions and a closure status for work sitting under tenant review.
  • Framework badges are theme-driven.
Fixes
  • The controls list paginates on the server, so a large framework opens at the speed a small one does.
  • A Common Control's validations are counted once, not once per framework that references it.
  • The framework header stops cramping at narrow widths.
  • The vendor portal opens from the platform without needing a token.