DottaandClaude Opus 5.5 e2b337b330 fix(authz): name the Experimental settings page when an agent is denied an instance experiment ...

An agent asked to turn on an instance experiment (for example Cases) reads
or patches /api/instance/settings/experimental and gets the generic
board-only denial, which names no page. Turning Cases off also denies the
case API with a bare "Cases are disabled". In both cases the agent cannot
tell the person where to act, so it cannot give a usable next step.

- The board-only denial for the experimental settings route now links
  [Open Experimental settings](/<prefix>/company/settings/instance/experimental),
  unless the operator hides that page.
- The case API gate keeps its message and adds a final remediation that names
  the same page (guarded the same way).
- The API catalog entries for the experimental settings route name the page,
  say agents cannot read or change it, and give Cases/enableCases as an example.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-11 12:17:15 -06:00

..

scripts

perf(issues): decide task reads for a list in one batch (#20858)

2026-11-11 10:42:21 -06:00

src

fix(authz): name the Experimental settings page when an agent is denied an instance experiment

2026-11-11 12:17:15 -06:00

test-baselines

…

CHANGELOG.md

…

package.json

feat(runner): upgrade ACPX to 0.22.0 and move patched behavior into Paperclip (#20770)

2026-11-11 07:28:00 -08:00

tsconfig.json

…

vitest.backup-qualification.config.ts

…

vitest.config.ts

…