Roles

Who in an organisation may make each dashboard write, checked by the API on every request.

Every member reads every screen. Support reads and makes no write.
The API reads the person's role from the organisation's own region on every request. A role in a token or a header is never read, so a change or a removal holds on the next request.
A write the role does not allow answers 403 with the code scope_missing.
A person with no membership, or one that has ended, is answered 404 for the organisation, never 403.
An organisation always keeps an owner. The last owner is never demoted or removed, and the answer is 409 with the code last_owner.
The person who creates an agent is never its sole approver, unless they are the only person at the company who can sign: that version answers sole_signer true.
The person who creates an organisation while signed in becomes its owner.

Who may write

Each dashboard write against the roles allowed
Write	Route	Owner	Admin	Finance	Support
Set whether an agent announces itself to sites	`POST /identity/machines/{mid}/edge`	Yes	Yes	No	No
Start the business check	`POST /org/kyb/start`	Yes	Yes	No	No
Create a pass	`POST /identity/machines`	Yes	Yes	No	No
Mint a pass's identity token	`POST /identity/machines/{mid}/token`	Yes	Yes	No	No
Revoke a pass	`POST /identity/machines/{mid}/revoke`	Yes	Yes	No	No
Register a new device's key	`POST /identity/machines/{mid}/keys`	Yes	Yes	No	No
Approve a new device's key	`POST /identity/machines/{mid}/keys/{fingerprint}/approve`	Yes	Yes	No	No
Revoke a device's key	`POST /identity/machines/{mid}/keys/{fingerprint}/revoke`	Yes	Yes	No	No
Start proving a domain	`POST /identity/domains`	Yes	Yes	No	No
Prove a domain	`POST /identity/domains/{domain}/prove`	Yes	Yes	No	No
Set the device policy	`POST /org/device-policy`	Yes	No	No	No
Set a pass's limit	`POST /mandates`	Yes	Yes	No	No
Change a pass's limit	`PUT /mandates/{mid}`	Yes	Yes	No	No
Propose an open mandate	`POST /mandates/{mid}/versions`	Yes	Yes	No	No
Sign or refuse an open mandate	`POST /mandates/{mid}/versions/{version}/decision`	Yes	Yes	No	No
Approve or refuse a purchase above the line	`POST /approvals/{aid}/decision`	Yes	Yes	No	No
Mark a pass that should not have passed	`POST /record/{rid}/mark`	Yes	Yes	No	No
Post an entry to the record	`POST /record`	Yes	Yes	No	No
Connect a wallet	`POST /wallets`	Yes	No	Yes	No
Push signed limits into a wallet	`POST /wallets/{wid}/push`	Yes	No	Yes	No
Export an evidence bundle	`POST /evidence/bundles`	Yes	No	Yes	No
Change a member's role	`POST /org/members/{uid}/role`	Yes	No	No	No
Remove a member	`POST /org/members/{uid}/remove`	Yes	No	No	No