Product Kind Ownership Restricts Service Writers

Context

The catalogue serves several applications, so one application's service must not mutate another's products. Console administration remains permission-based across those kinds.

Decision

Product service callers must match the kind's application owner, while authorized console and system logic can write across owners.

Alternatives Considered

Match console writes to the originating screen's application. The caller context does not reliably identify the screen that submitted the request.

Let every service write every kind. This removes the protection between application owners.

Consequences

Both product write paths check application ownership. Those checks do not prove extension completion or enforce the console's navigation choices.