Method requireAccountScope

internal/httpapi/scope.go:26–36

Scope enforcement — the hard scope ceiling (Slice 5a / design §5 / decision 10). A credential's scope, not its auth method, bounds its blast radius: - account scope: account-wide admin (agent/domain/key management, account settings). Reaches everything the owner owns. - agent scope: bound to a sing

(ctx context.Context)

// domain claim/verify/delete, API-key and account management) — the structural
// guarantee that a leaked agent credential cannot widen its own authority.
func (s *Server) requireAccountScope(ctx context.Context) (*identity.Principal, error) {
	p, err := s.requirePrincipal(ctx)
	if err != nil {
		return nil, err
	}
	if p.Scope != identity.ScopeAccount {
		return nil, NewError(http.StatusForbidden, "forbidden",
			"this operation requires an account-scoped credential; agent-scoped credentials cannot perform account administration")
	}
	return p, nil
}

// requireAccountUser is the user-returning convenience over requireAccountScope
// for the many account-admin handlers that only need user.ID — a clean drop-in