Mage project Git actions could be granted after a failed role check

An authenticated Mage AI user could reach repository changes without the required role because a failed authorization check did not reliably stop the rest of the handler. The defect was not authentication bypass in itself. It appeared after the user had a session, when a Viewer or unassigned account should have been denied the relevant Git project mutation.

The maintainer's PR #6207 changes role and fine-grained permission checks to reject the request before a write path is reached. Tests cover denied Viewer and unassigned configurations as well as Editor and Administrator behavior. The patch was merged into source on October 16, 2026. As with other Mage changes, a merge is not independent proof that any particular release image has shipped or that all related endpoints have been exercised in production.

This is a server authorization boundary, separate from OAuth provider identity validation and from shell command parsing in Git actions. A session can be genuine while a mutation remains unauthorized. Verification should apply a role-by-endpoint matrix and compare actual created branches, project files and remotes before and after each denied call, rather than relying only on a 403 response or on front-end role labels.