Source: MIZOKI audit 2026-09-06 (pinned fc8b03f9) → work-order backlog 2026-09-08 (docs/audits/AUDIT_WORK_ORDERS_2026-09-08.md). Findings are hypotheses until reproduced on current main (WO-00).

Finding: Onboarding page requires admin, but economics / cost / connector-credential save handlers check tenant identity only; viewer identity returned 200 and invoked all three saves [R15][R16]. Files: miz-oki-command-center-ui/app/api/bff/tenant-economics/save/route.ts; connector credential save route under app/api/bff/connectors/; reference pattern in app/api/bff/actions/authorize/route.ts. Fix: apply the canonical role + actor check from the authorize route to all three mutations; backend economics/cost routes verify end-user role, not just service + tenant. Acceptance: Vitest: viewer → 403 on all three, no adapter call; admin → 200. Backend route test with valid service token but viewer role → 403. Depends on: WO-00.