User Organization User Role Partial Update

Serializer for organization user roles.

Security Note: Privilege escalation prevention is handled at the VIEW level (OrganizationMemberView), not here. This serializer is used by org admins to update member roles, so fields (role, permissions_override, ...) must remain writable. The view gates all writes on org admin via is_requiring_org_admin_for_write = True — a member cannot PATCH their own row to escalate. Any new write path using this serializer MUST apply the same admin gate, since the fields here are privilege-defining.

Serializer for organization user roles.

Security Note: Privilege escalation prevention is handled at the VIEW level (OrganizationMemberView), not here. This serializer is used by org admins to update member roles, so fields (role, permissions_override, ...) must remain writable. The view gates all writes on org admin via is_requiring_org_admin_for_write = True — a member cannot PATCH their own row to escalate. Any new write path using this serializer MUST apply the same admin gate, since the fields here are privilege-defining.