GuidesAPIMCP

Team-scoped access (permanent)

Team-scoped envelope/template access is always on in application code. There is no TEAMS_ENFORCE env flag and no legacy user_id-only access path.

Before orgs/teams were fully backfilled, access used user_id ownership. A temporary env flip gated rollout so the product could ship teams UI without breaking solo users mid-migration. That migration is done; Agency and other multi-team orgs need sharing by team membership. The flag was technical debt and has been removed.

Behavior

  • Members see only resources on their assigned teams.
  • Org admins see every team in the org.
  • Personal orgs / solo users still use their General team (auto-resolved on create when they have one accessible team or a default_team_id).
  • Multi-team actors must pass team_id (or have a valid default_team_id) on create; otherwise team_id_required.

Verification

npx jest --testPathPatterns='teams-enforce-prep|access-control|resolve-team-id|resolve-envelope-team|resolve-pin-team'
npm run validate:org-migrations
npm run agency:status

Gates that must stay green:

  • teams-enforce-prep (shared templates, team_id_required, org+team list filter)
  • access-control team-scoped rules
  • resolveCreateTeamId multi-team path
  • validate:org-migrations: no org_id without team_id on envelopes/templates; profiles have primary_org_id + default_team_id

Obsolete env

Do not set TEAMS_ENFORCE in Vercel. The variable is ignored if present; delete it from Production/Preview when convenient so it cannot be mistaken for a live control.