User Organization User Role Retrieve

GET/PATCH/DELETE /api/users/member/<id>/

Retrieve, update, or delete organization member role.

Permission (via ObjectOwnershipMixin config in SuperAdminMixin):

• User can GET their OWN role (read-only)
• Org Admin can GET/PATCH/DELETE any role in org
• Superadmin: same as regular user (org-scoped, not cross-org)

Note: Member management is intentionally org-scoped even for superadmins.

Writes are admin-only. Every writable field on OrganizationUserRole (role, permissions_override, pending, ...) is privilege-defining, so a member must NOT be able to PATCH their own row — that is direct self-escalation to admin/owner. is_requiring_org_admin_for_write enforces org-admin for any write while still letting members GET their own role. Role changes go through this admin-gated path (the serializer keeps fields writable for that flow); members have no legitimate self-write field here.