Escalate every open request past its SLA deadline, ACROSS TENANTS.
Idempotent: already escalated records are not re-escalated (their status
left the guard set). Cron-owned TCB code — deliberately NOT a service
method and NOT reachable over HTTP: an unfiltered cross-tenant read+write
behind a role check was an IDOR-shaped hole (any CAN_SWEEP actor could
escalate every tenant's queue). The distinct SystemApprovalStore parameter
type makes "cross-tenant reads happen only inside the TCB" a compile-time
property, not a convention.
Escalate every open request past its SLA deadline, ACROSS TENANTS. Idempotent: already escalated records are not re-escalated (their status left the guard set). Cron-owned TCB code — deliberately NOT a service method and NOT reachable over HTTP: an unfiltered cross-tenant read+write behind a role check was an IDOR-shaped hole (any CAN_SWEEP actor could escalate every tenant's queue). The distinct SystemApprovalStore parameter type makes "cross-tenant reads happen only inside the TCB" a compile-time property, not a convention.