Organization settings
A viewer can inspect settings while the caller-owned policy disables mutation.
Organization identity
Names, URLs, defaults, and notifications remain application-owned settings.
Owner access required
This signed-in viewer can inspect organization settings but cannot change them.