The PR hardens multi-tenant access control by requiring workspace-scoped validation for platform issue/project/agent operations and by allowing only workspace owners to grant admin or owner roles.
Scattered source updates, isolated context, and manual follow-up across multiple feeds.
Introduced explicit workspace boundary checks and role-privilege guards so issue/project/agent APIs reject cross-tenant target IDs and role changes to admin/owner can only be done by workspace owners.
Platform admins and workspace operators are better protected from accidental data exposure and unauthorized elevation because cross-workspace resource operations and owner-level role grants are now blocked unless the caller is authorized. Concretely, the change enforces workspace-scoped authorization on service actions and tightens role assignment policy to owners only; teams should watch for integration breakage in existing scripts or tools that previously relied on cross-workspace IDs or non-owner role delegation.
Platform admins and workspace operators are better protected from accidental data exposure and unauthorized elevation because cross-workspace resource operations and owner-level role grants are now blocked unless the caller is authorized. Concretely, the change enforces workspace-scoped authorization on service actions and tightens role assignment policy to owners only; teams should watch for integration breakage in existing scripts or tools that previously relied on cross-workspace IDs or non-owner role delegation.