From 483df5891446521482cf57e8e2d94fdf3db5b2db Mon Sep 17 00:00:00 2001
From: Nikolay Edigaryev <edi@openai.com>
Date: Mon, 19 Oct 2026 22:41:31 +0100
Subject: [PATCH] Controller: require compute:write for GET /v1/rpc/watch
 endpoint

---
 internal/controller/api_rpc_watch.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/internal/controller/api_rpc_watch.go b/internal/controller/api_rpc_watch.go
index 73ca879b..584e998a 100644
--- a/internal/controller/api_rpc_watch.go
+++ b/internal/controller/api_rpc_watch.go
@@ -16,7 +16,7 @@ import (
 
 //nolint:protogetter // Preserve the original host-process wire conversion.
 func (controller *Controller) rpcWatch(ctx *gin.Context) responder.Responder {
-	if responder := controller.authorize(ctx, v1.ServiceAccountRoleComputeRead); responder != nil {
+	if responder := controller.authorize(ctx, v1.ServiceAccountRoleComputeWrite); responder != nil {
 		return responder
 	}