Any employee in the org could send a message as the board (freeze, takeover,
force-approval), because requireSender only checked that the board sender was a
valid employee. Enforce the approval_decider role (org_admin inherits it) via
IdentityAccessService, which also records an access decision for denied
attempts, and only render the thread board-control form for principals who hold
that authority — others get a read-only view of past interventions.
ZacharyZhang-NY
43e1626f77