Edit Issue - .issue.db

Title *

Description

EARS SPEC:
- When a caller who is not a member of tenant T with the required permission calls any /agents, /sessions, /triggers/rules, /automations, /agent-runs, Gmail or Telegram route for T, the API shall return 403 before any read or write.
- The idempotency reset routes shall delete only the caller's tenant's rows; a cross-tenant or platform-wide reset shall need a platform-only permission.
EVIDENCE (#931, live, GET only): a JWT for an identity with no role in tenant test gets 403 on GET /api/v1/workflows but 200 on GET /agents, /sessions, /triggers/rules, /automations, /agent-runs (20 run names). The POST/DELETE handlers in api/management.py, api/oauth_handlers/gmail_push.py, telegram_int.py, gmail.py have no permission check either (not exercised). POST /api/v1/idempotency/reset-all runs DELETE FROM task_execution_log WHERE idempotency_key IS NOT NULL with no tenant filter, and DELETE /idempotency/<key> likewise, both under manage_system, which tenant_admin holds; circuit-breaker reset, activities/cleanup-heartbeats and workers/summary have the same pattern with lower impact. Full table: SPECS/931-route-classification.md.

Due Date (YYYY-MM-DD)

Tags (comma separated)

Related Issues (IDs)

Enter IDs of issues related to this one. They will be linked as 'related'.

Edit Issue #1032