one-pipe-system/openspec/changes/enforce-audit-subject-api-boundaries/tasks.md

1. Shared Access Rules

• 1.1 Add shared current-user access checks for platform audit and subject activity APIs.
• 1.2 Guard the shared investigation loader so it does not request a platform audit API for agent or enterprise users.

2. Entry Points and Pages

• 2.1 Update business audit entry points to pass current user type and use only supported subject activity targets for agents and enterprises.
• 2.2 Hide or block platform audit routes and actions for agent and enterprise users.
• 2.3 Keep finance, risk, Integration and link-timeline entries platform-only.

3. Read-only Verification

• 3.1 Verify all audit and subject-activity methods used by the UI are GET-only.
• 3.2 Verify platform, agent and enterprise users cannot trigger the wrong API family.
• 3.3 Run lint and type checks for changed files.