Permission gate: resolve requireCap (manageUsers vs new supportTickets cap) + audit design-ping (schema+authz+email triple-trigger) BEFORE impl

Sub-tickets

Questions

Activity

• wi-cli-venus created · 2026-06-21
  parent=#1231
• wi-cli-venus canceled · 4w ago
  Superseded by PLUTO-193 (already shipped/closed): audit-pluto-ca confirms manageSupport is the correct exclusive cap already live on /admin/soporte list/detail (requireCap) + all mutations (requireCapForAction) + nav — administrador holds manageSupport, manageUsers only gates the optional user-detail link, reporter /soporte stays authenticated self-service with ownership enforcement, internal agent API keeps its own bearer boundary. No duplicate schema/authz work needed.