Decisions 239 and 247 to 249: the special rights agent_use and llm_use are enforced where they apply, object_publish and dashboard_view are retired, and only an administrator or the organisation's owner can change who holds a special right.

OpenSpec change: openspec/changes/enforce-organisation-special-rights/ (proposal, design with the file and line of every enforcement point, spec delta, tasks).

What is enforced, and where

Semantic and hybrid search embed the query with an embedding model and do not need llm_use (decision 249); they are unchanged.

The one reader is still OrganisationSpecialRights from #4601. It gains mayUse() (administrators pass, * means every signed-in user, a key the organisation never set does not narrow, a named organisation that cannot be loaded refuses, no organisation and no default organisation does not narrow) and openToEveryoneInEveryOrganisation().

A refused chat returns 403 from /api/chat/send, a forbidden frame naming the right from /api/chat/stream (its headers are already sent, as for a conversation that is not yours), and a JSON-RPC error from MCP. Nothing is stored and no model is called.

Retired: object_publish and dashboard_view (decisions 247, 248)

Neither was ever enforced: objects have had no publish action since migration Version1Date20260313130000, and /api/dashboard/* is administrator only. Both are removed from the organisation's defaults, the editor's Special Rights tab, the frontend entity, the admin-group backfill, the upgrade step and the docs. An organisation that still stores them loads and is served unchanged; nothing reads them and nothing writes them.

Who changes special rights

PUT/PATCH /api/organisations/{uuid} refuses a change to agent_use, llm_use or grant_manage from anybody but an administrator or the owner (403 with rights naming them). #4601 did this for grant_manage only. A member still edits the rest of the organisation. The Special Rights tab is read-only for them and says why, and offers "Everyone" (*).

Upgrade notes: what becomes refused for whom

Nothing, on the day of the upgrade. Before, every signed-in user could chat and run agents whatever the lists said, and the lists said [] or ["admin"] on most organisations. The post-migration repair step OpenSpecialRightsToEveryone adds * beside the stored groups under agent_use and llm_use in every organisation, once (app config special_rights_opened_to_everyone), and never touches grant_manage or the retired keys. A new organisation starts with ["*"] under both.

After that, taking * out of a list refuses users outside its groups, and a later upgrade does not put it back. object_publish and dashboard_view were never enforced, so retiring them refuses nobody; they disappear from the editor, and values already stored are ignored.

Verified

Run once in the foreground on this branch:

• phpcs 0, phpmd (with HOME set to an empty dir, both rule sets, whole lib/) 0 and 0, psalm --threads=1 0 (no errors), phpstan 0
• phpunit --no-coverage: the 328 tests around this change pass (Rbac, chat, MCP, organisation controller and model, repair step, OrganisationService). The full Unit suite on the previous commit: 26,183 tests, 15 errors, all OC\DB\Schema\Table is not loadable (13 AuditTrail and 2 DraftRemovalAuditRow tests need an installed Nextcloud)
• jest on src/entities/organisation 4/4, npm run lint 0 (warnings only; the editor's ellipsis suppression count went down from 8 to 6 with the two removed rows), prettier 0, test:l10n OK

Not verified live: no instance was used. Both endpoints are plain Controllers, not OCSControllers, so OCSMiddleware leaves the 403 as it is; the tests assert that, and drive the real controller over the real ChatService and the real reader.

Inherited: the 15 PHPUnit errors above; 942 eslint warnings, none in the changed lines.