Block a user
[Feature] Move delegation ceilings and "more restrictive only" validation into policy
Codex State: done
Summary
- Moved reusable delegation-ceiling and more-restrictive-only checks into the policy module helper.
- Retention keeps its existing validation messages while…
[Feature] Target-state module update planner
Implemented the next update-planner slice: module-aware migration execution planning.
Done now:
- added manifest/catalog migration ordering metadata: migration_after and migration_before -…
Policy-gated resource access explanation user picker
Decide campaign sub-object resource access explanation scope