fix(access-control): keep the settings page open while an organization is governed

[waleedlatif1]

Summary

Follow-up to #7886, which stopped a failing payment from lifting an organization's permission groups. That fix left the two halves disagreeing: the restrictions kept applying, but the Access Control page was still hidden with the rest of the Enterprise sections — so an organization could be governed by rules nobody could see or loosen until the invoice cleared.

• OrganizationSettingsFeatures gains governanceActive, and Access Control reads it instead of the plan gate. It defaults to the plan gate, so every other caller keeps its current behaviour untouched.
• The page gate and the navigation both pass the real value, so what the nav lists and what the route opens agree.
• The management API goes back to the governance reader. It had been deliberately left on the plan gate so it could not open while the page 404'd; with the page fixed, that reason is gone.
• Nothing else moves: every other section still reads the plan gate, because withholding a feature during a payment failure is the safe direction — withholding a restriction is not.

Only Access Control performs the extra lookup, so no other settings page pays for it.

Type of Change

• Bug fix

Testing

Tested manually. bun run lint, bun run type-check, bun run check:audits (46 audits), bun run check:api-validation and bun run docs-manifest:check all pass; the full suite runs 52,295 tests green. New tests cover an organization that is governed without an active plan (page opens, nav lists it), one that is governed by nothing (both closed), and that no other section reads governance — each verified to fail without the change.

Also removes a stray Open http://localhost:3000 line from the README's self-hosted quick start. The fuller self-hosting section below it already tells you where to look once the wizard finishes, so the line was duplicating that a few paragraphs earlier.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 16, 2026 8:31pm UTC

[cubic-dev-ai]

All reported issues were addressed across 10 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the previous authorization, shared-surface failure, and redundant-read findings are resolved without introducing a new actionable issue.

Summary

This PR keeps Access Control available while an organization’s permission-group regime remains active, even when its ordinary Enterprise plan gate closes during a payment failure.

• Separates governance availability from ordinary Enterprise feature availability across organization and workspace settings.
• Aligns navigation, page authorization, and permission-group management API behavior.
• Prevents governance lookup failures in shared organization navigation data from breaking unrelated organization pages.
• Removes an unnecessary README quick-start line.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Open organization or workspace settings] --> B{Access Control section?}
  B -- No --> C[Read ordinary Enterprise plan gate]
  B -- Yes --> D[Read active permission-group regime]
  C --> E[Evaluate section availability]
  D --> E
  E --> F{Available and caller authorized?}
  F -- Yes --> G[Show and open section]
  F -- No --> H[Hide or deny section]

Loading

_{Reviews (2) · Last reviewed commit: "fix(access-control): read the active per..."}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 13 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}