- Shipped
- August 15, 2026 at 6:40 AM UTC
- Author
- Kamo
- Commit
- 41010b8
The gate was already there and refusing callers — on MANAGE_SUPPORT, the parent — so CREATE_SUPPORT_TOPICS read as decorative in every editor while being exactly the capability being checked. Checking only the child is correct: hierarchy closure revokes CREATE_SUPPORT_TOPICS whenever MANAGE_SUPPORT is not granted, so holding the child implies the parent. Update and delete keep MANAGE_SUPPORT — this right names creation and nothing else. Nobody loses anything, measured rather than assumed: the two are held by the same 15 roles and 47 members, with zero members holding MANAGE_SUPPORT without this one. This is a third thing "decorative" can mean, after genuinely-ungated and **************** and the only one that costs nothing to correct. It is also invisible to the analyzer, since the parent is enforced and nothing looks wrong from the outside.