- Shipped
- September 6, 2026 at 6:52 AM UTC
- Author
- Kamo
- Commit
- 65a2dca
SecurityService now refuses to grant a right the caller does not hold themselves — an administrator may create a peer or a lesser, never a superior. The Manage Rights dialog has to draw the same line, or the operator meets it as an unexplained 403 after ticking boxes that looked available. Those switches are locked rather than hidden, with the sentence saying why in place of the right's description and a count in the header. A control that vanishes reads as a missing feature; one that explains itself reads as a rule. Grant all grants what this editor may grant, and the row click is closed off too, so the switch is not reachable around the side. A right the target ALREADY holds stays live even for an editor who lacks it. The dialog sends the complete set rather than a diff, so that right appears in every save; locking it would make every administrator more privileged than the person editing them impossible to edit at all. That is exactly the delta the endpoint judges, so the two agree switch for switch.