The global WriteAccessGuard was checking req.user.role, but req.user is set by JwtAuthGuard (a per-controller guard) which runs AFTER global guards. TenantMiddleware sets req.userRole from the JWT before guards execute, so we now check that property first. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>