PT-2026-76479

Summary An authenticated user whose features.image generation permission has been revoked can still make the server generate images by sending the feature flag in a chat-completion request. The chat pipeline took the client-supplied features object at face value and never re-checked the permissio...