Map brand kit routes to asset scopes

app/security/policy.py

@@ -80,6 +80,13 @@ class ScopePolicy:
             if method == "DELETE" or path.endswith("/cancel"):
                 return "jobs:cancel"
             return "jobs:create"
+        # Brand kits are workspace-owned assets; use the established asset scopes.
+        if path == "/v1/brand" or path.startswith("/v1/brand/"):
+            if method == "GET":
+                return "assets:read"
+            if method == "DELETE":
+                return "assets:delete"
+            return "assets:write"
         if path.startswith("/v1/assets"):
             if method == "GET":
                 return "assets:read"