Policies were globally shared: visible() returned every stored policy to every user, and access checks were removed (#6625's 'org-wide' model), so a team leader could see and edit policies belonging to other teams/orgs. Stamp each policy with the creating user's teamId (server-side, persisted in the policy JSON — no migration) and scope all access by it: list/get/run/edit/delete are restricted to the caller's team. This binds everyone, admins included — there is no cross-team escape. The edit-role gate (team leader) is unchanged and now composes with team scoping.
Current user's team is resolved per build via PolicyManagementAuthority.currentUserTeamId() (SaaS: team-security resolution; self-hosted: the user's team). Tests cover team-filtered visibility/access and the team-id resolution.
Reece
0209bda04a