# Platform-wide routes require the operator account

Telemetry, monitoring and the diagnostic endpoints were reachable with a permission that every role holds, which exposed server metrics to any tenant.

> Security · 2026-09-12 · Dashboard, Platform

- The audit log is now scoped to the calling account, with the platform-wide view reserved for the operator