Preserve source and target authorization when relocating shared dashboard data
When relocating a client-side dashboard widget between separately protected surfaces, treat its data endpoint as a shared boundary: preserve the original authorization path, add only the target surface’s narrow capability as an alternative, and test both independent access paths …