Ensure workspace roles retain baseline read scopes

app/security/studio_identity.py

@@ -10,6 +10,32 @@ from app.security.context import AuthContext
 from app.security.scopes import DEFAULT_ROLE_SCOPES
 from app.security.tenancy import TenantPrincipal
 
+# Every workspace role is allowed the same baseline read capabilities. Keep this
+# explicit so new UI read endpoints do not fail closed merely because a role's
+# mutation scopes differ.
+STUDIO_BASELINE_READ_SCOPES = frozenset({
+    "templates:read",
+    "operations:read",
+    "jobs:read",
+    "assets:read",
+    "mcp:read",
+    "system:read",
+    "social:accounts:read",
+    "social:posts:read",
+    "social:schedules:read",
+    "social:analytics:read",
+    "analytics:read",
+    "generation:providers:read",
+    "generation:requests:read",
+    "ai:read",
+    "copilot:read",
+    "projects:read",
+    "members:read",
+    "teams:read",
+    "comments:read",
+    "approvals:read",
+})
+
 _HEX_SHA256 = re.compile(r"^[a-f0-9]{64}$")
 
 
@@ -79,10 +105,11 @@ def constrain_context_to_membership(
     effective_role = role_map.get(raw_role)
     if effective_role is None:
         raise ValueError("Unsupported workspace membership role.")
+    role_scopes = DEFAULT_ROLE_SCOPES[effective_role] | STUDIO_BASELINE_READ_SCOPES
     return replace(
         context,
         role=effective_role,
-        scopes=frozenset(context.scopes.intersection(DEFAULT_ROLE_SCOPES[effective_role])),
+        scopes=frozenset(context.scopes.intersection(role_scopes)),
         workspace_id=principal.workspace_id,
         user_id=principal.user_id,
         membership_id=principal.membership_id,