AIKIDO-2026-162782

TL;DR

The scope-enforcement decorator treats a filtered admin scope as sufficient whenever a request carries no explicit resource filter, deferring any filtering to the request handler. Endpoints that create users or groups do not apply that deferred filtering, so a user granted a filtered admin scope such as admin:users!group=... or admin:groups!group=... can create users or groups outside their permitted scope. Before the fix this lets a partially privileged admin act beyond its assigned resource filter. The fix makes post-filtering explicit and opt-in so only listing endpoints accept filtered access.