[czpython]

A write that changes what other accounts get is now an admin task, and it comes from the browser only. A token cannot make one, also an admin's token. A write to a person's own credential or preference keeps the gate it had.

Each route has one access class, and the gate is a dependency on the route.

Admin only

• Installation settings and app settings, with schedule cadence and pause.
• Service connections, the GitHub App manifest, and provider API keys.
• MCP servers: add, remove, enable, scopes, the installation's key, and the connect that picks how a server holds its credential.
• Skills, browser profiles and their login window, and notification destinations.
• WhatsApp numbers, Twilio numbers, and the one-time code on a public Bot's number.

Routes that are now two

Some routes served a shared write and a personal write at one address. Each is now an admin route and a route for the caller's own credential:

Admin	Caller's own
GET /api/oauth/{slug}/install	GET /api/oauth/{slug}/connect
PUT, DELETE /api/mcp-servers/{name}/headers	PUT, DELETE /api/mcp-servers/{name}/headers/me
POST /api/mcp-servers/{name}/connect	POST /api/mcp-servers/{name}/connect/me
DELETE /api/mcp-servers/{name}/grant	DELETE /api/mcp-servers/{name}/grant/me
POST /api/chat/connections/{id}/one-time-code	POST /api/chat/connections/{id}/pairing

A /me route answers 409 on a server that holds one credential for every account. A connect through /me leaves the server as an admin set it.

Dashboard

A member sees no control that the API refuses. Agents, Skills, the Browser tab, and each app's settings pages are hidden for a member. Providers, Services, MCP servers, and Schedules show a member the state and the member's own controls. A member sees only the MCP servers that are enabled.

The auth boundary test now puts every platform write route in exactly one access class, so a new shared write cannot ship without a choice.