Files
zooqueenandHanzo Dev 554f45454c Only the reserved admin org's provider rows are the platform's, and no row reaches the hosted compute account (red round 2, item 1).
platformOwner named any org, and any member of that org could write a row in it, so a hanzo member's AWS row named hanzo-compute drove the hosted account: listing every tenant's instance and stopping them. The platform owner is now the one SuperAdmin predicate, owner == "admin", with the platformOwner setting removed. A row naming AWS hanzo-compute is refused for every owner, and hosted compute alone reaches that account.

Co-authored-by: Hanzo Dev <[email protected]>
2026-09-24 05:59:52 -07:00
..