Weekly Permissions sync 2026-03-30

[marabooy]

Weekly Permissions sync 2026-03-30

[Copilot]

Pull request overview

Updates the permissions map as part of the weekly sync by adding newly available Data Security & Governance upload-session routes.

Changes:

• Added contentUploadSession paths for both /me and /users/{userId} DataSecurityAndGovernance namespaces.
• Updated in two permission blocks (one where processContent routes have empty constraints, one where they specify least=...).

Comments suppressed due to low confidence (1)

permissions/new/permissions.json:1

• The newly added contentUploadSession entries use an empty constraint string, but related routes in this section mix empty constraints (processContent) with an explicit least=Application,DelegatedWork (processContentAsync). If empty string is a meaningful sentinel here, it would help to standardize constraints across closely related endpoints or add a short inline explanation of what "" means, to avoid accidentally granting broader access than intended when new routes are introduced.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.