docs(spec): presets have no access control of their own

Preset routes need no RBAC permission; a submit made from a preset is
checked like any other submit.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.kiro/specs/application-profile/brief.md

@@ -654,8 +654,9 @@ defaults a profile does not (everything but default reservations):
   into its own local file, so a server preset being removed never affects
   users. `preset diff` / `pull --force` are user-initiated.
 - User-to-user sharing by `preset export` / `import` (file, mail, git).
-- Presets carry no privilege: `queue:submit` (later `app:use`), the profile's
+- Presets have no access control of their own (user, 2026-10-12): the
-  essentials, queue ceilings and project quotas still apply at submit.
+  preset routes need no RBAC permission, and a submit made from a preset is
+  checked like any other submit. Presets carry no privilege.
 
 ### Dispatch record
 Decided 2026-10-12 (user): what a job was scheduled and started with is

.kiro/specs/xcecli-presets/brief.md

@@ -19,10 +19,12 @@ configuration level.
   --preset <name>` expands it; any command-line flag replaces the preset's
   value for that option as a whole (no resreq parsing). The submit carries
   only the expanded values.
-- **Handled fully on the client.** Presets never reach the controller, WAL
+- **Handled fully on the client, with no access control of their own**
-  or scheduler, own no attribute, are not a configuration level and carry
+  (user, 2026-10-12). Presets never reach the controller, WAL or scheduler,
-  no privilege: `queue:submit` (later `app:use`), the profile's essentials, queue
+  own no attribute, are not a configuration level and carry no privilege.
-  ceilings and project quotas still apply at submit.
+  Nothing checks who may use, pull or share a preset: a submit made from a
+  preset is an ordinary submit, checked like any other (`queue:submit`, the
+  profile's essentials, queue ceilings, project quotas).
 - **One file per preset** (user, 2026-10-12), the same layout on client
   and server:
 
@@ -50,8 +52,9 @@ configuration level.
   change them on the fly (`xcecli preset set / edit / show / list / delete`).
 - **The server only shares.** The apiserver serves admin-deployed preset
   files read-only: `GET /xce/v1/presets` (list, with each preset's content
-  hash) and `GET /xce/v1/presets/{name}` / `{ns}/{name}` (fetch). Every
+  hash) and `GET /xce/v1/presets/{name}` / `{ns}/{name}` (fetch). No RBAC
-  authenticated user may see them.
+  permission on these routes (no `RequirePermission`): any logged-in user
+  may list and fetch them, behind the usual middleware chain.
 - **Where server presets live** (user, 2026-10-12): a directory beside the
   apiserver's other config, `<TopDir>/config/presets/` (as
   `config/rbac.yaml` and `config/auth.yaml`, `apiserver/cmd/main.go:144`,