From de4a75484614863fdc84f313f2cd13d0d810b695 Mon Sep 17 00:00:00 2001
From: "Beau Beauchamp, WebTigers" <beau@webtigers.com>
Date: Wed, 21 Oct 2026 10:08:38 -0400
Subject: [PATCH] =?UTF-8?q?TIGER-335=20batch=204:=20=5FisAdmin()=20?=
 =?UTF-8?q?=E2=86=92=20=5FisAllowed()=20in=20sms/seo/mcp/register/media/bl?=
 =?UTF-8?q?og/cms=20(v1.35.0)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Seven modules whose admin services are wildcard-privilege grants → behavior-preserving mechanical
conversion (register also had the _isAdmin('Register_AdminController') cross-resource form). Audited
each module's guest grant: all sit on genuinely-public CONTROLLERS (webhooks, sitemap, verify, index),
not the admin services with the in-method checks — so no F5 hole, no acl.ini change. Tests green: 515.

Closes TIGER-337, TIGER-341, TIGER-342, TIGER-347, TIGER-348, TIGER-352, TIGER-353.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ASauLLscjqdsNqBNsx2Typ
---
 CHANGELOG.md                               | 11 +++++++++++
 library/Tiger/Version.php                  |  2 +-
 modules/blog/services/Post.php             | 12 ++++++------
 modules/blog/services/Taxonomy.php         |  2 +-
 modules/cms/services/Menu.php              | 18 +++++++++---------
 modules/cms/services/Page.php              | 22 +++++++++++-----------
 modules/cms/services/Paths.php             |  2 +-
 modules/cms/services/Settings.php          |  2 +-
 modules/mcp/services/Settings.php          |  8 ++++----
 modules/media/services/Media.php           | 12 ++++++------
 modules/media/services/Settings.php        |  8 ++++----
 modules/register/services/Registration.php |  8 ++++----
 modules/seo/services/Social.php            |  4 ++--
 modules/sms/services/Settings.php          |  4 ++--
 14 files changed, 63 insertions(+), 52 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 25ee8f00..19f530e4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,17 @@ All notable changes to **Tiger Core** (`webtigers/tiger-core`). Format follows
 
 ## [Unreleased]
 
+## [1.35.0] — 2026-10-21
+
+### Changed
+- **TIGER-335 migration (batch 4)** — `_isAdmin()` → `_isAllowed('<method>')` across seven modules whose
+  admin services are wildcard-privilege grants: **sms** (TIGER-352), **seo** (TIGER-353), **mcp**
+  (TIGER-348), **register** (TIGER-347, incl. the `_isAdmin('Register_AdminController')` cross-resource
+  form), **media** (TIGER-341), **blog** (TIGER-342), **cms** (TIGER-337). Behavior-preserving.
+  **Audit note:** these modules' `guest` grants were confirmed to sit on genuinely public *controllers*
+  (sms inbound webhook, seo sitemap/robots/llms, mcp server, register verify, blog/cms index) — **not**
+  on the admin services carrying the in-method checks, so there was no F5 hole here (no acl.ini change).
+
 ## [1.34.0] — 2026-10-21
 
 ### Changed
diff --git a/library/Tiger/Version.php b/library/Tiger/Version.php
index fc6cd5bc..d476547d 100644
--- a/library/Tiger/Version.php
+++ b/library/Tiger/Version.php
@@ -9,5 +9,5 @@
 class Tiger_Version
 {
     /** Current Tiger Core version. Keep in lockstep with the git tag cut for a release. */
-    const VERSION = '1.34.0';
+    const VERSION = '1.35.0';
 }
diff --git a/modules/blog/services/Post.php b/modules/blog/services/Post.php
index 48433220..92481c35 100644
--- a/modules/blog/services/Post.php
+++ b/modules/blog/services/Post.php
@@ -22,7 +22,7 @@ class Blog_Service_Post extends Tiger_Service_Service
      */
     public function datatable(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('datatable')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $dt    = $this->_dtParams($params);
         $model = new Blog_Model_Post();
@@ -35,8 +35,8 @@ public function datatable(array $params): void
             'limit'    => $dt['length'],
         ]);
 
-        $canEdit   = $this->_isAdmin(static::class, 'save');
-        $canDelete = $this->_isAdmin(static::class, 'delete');
+        $canEdit   = $this->_isAllowed('save');
+        $canDelete = $this->_isAllowed('delete');
 
         $rows = [];
         foreach ($data['rows'] as $r) {
@@ -69,7 +69,7 @@ public function datatable(array $params): void
      */
     public function save(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('save')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $form = new Blog_Form_Post();
         if (!$form->isValid($params)) { $this->_formErrors($form); return; }
@@ -138,7 +138,7 @@ public function save(array $params): void
      */
     public function delete(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('delete')) { $this->_error('core.api.error.not_allowed'); return; }
         $id = !empty($params['post_id']) ? (string) $params['post_id'] : '';
         if ($id === '') { $this->_error('core.api.error.general'); return; }
 
@@ -158,7 +158,7 @@ public function delete(array $params): void
      */
     public function restore(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('restore')) { $this->_error('core.api.error.not_allowed'); return; }
         $id      = !empty($params['post_id']) ? (string) $params['post_id'] : '';
         $version = isset($params['version']) ? (int) $params['version'] : 0;
         if ($id === '' || $version < 1) { $this->_error('core.api.error.general'); return; }
diff --git a/modules/blog/services/Taxonomy.php b/modules/blog/services/Taxonomy.php
index aff99684..41d3b64a 100644
--- a/modules/blog/services/Taxonomy.php
+++ b/modules/blog/services/Taxonomy.php
@@ -21,7 +21,7 @@ class Blog_Service_Taxonomy extends Tiger_Service_Service
      */
     public function listTerms(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('listTerms')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $vocab = ($params['vocabulary'] ?? '') === Blog_Model_Taxonomy::VOCAB_CATEGORY
             ? Blog_Model_Taxonomy::VOCAB_CATEGORY : Blog_Model_Taxonomy::VOCAB_TAG;
diff --git a/modules/cms/services/Menu.php b/modules/cms/services/Menu.php
index b2cd6df1..e340d811 100644
--- a/modules/cms/services/Menu.php
+++ b/modules/cms/services/Menu.php
@@ -54,11 +54,11 @@ protected function _menuOrgId()
      */
     public function datatable(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('datatable')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $dt        = $this->_dtParams($params);
-        $canEdit   = $this->_isAdmin(static::class, 'save');
-        $canDelete = $this->_isAdmin(static::class, 'deleteMenu');
+        $canEdit   = $this->_isAllowed('save');
+        $canDelete = $this->_isAllowed('deleteMenu');
 
         // Theme display names (all installed) so a menu shows its origin theme even after deactivation.
         $active = Tiger_Theme::active();                 // {key, name, dir}
@@ -158,7 +158,7 @@ protected function _countNodes(array $nodes): int
      */
     public function save(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('save')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $menuKey = trim((string) ($params['menu_key'] ?? ''));
         if ($menuKey === '') { $this->_error('cms.menu.key_required'); return; }
@@ -218,7 +218,7 @@ public function save(array $params): void
      */
     public function delete(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('delete')) { $this->_error('core.api.error.not_allowed'); return; }
         $id = (string) ($params['menu_id'] ?? '');
         if ($id === '') { $this->_error('core.api.error.general'); return; }
         $menuKey = (string) ($params['menu_key'] ?? '');
@@ -243,7 +243,7 @@ public function delete(array $params): void
      */
     public function deleteMenu(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('deleteMenu')) { $this->_error('core.api.error.not_allowed'); return; }
         $menuKey = (string) ($params['menu_key'] ?? '');
         $orgId = $this->_scopedOrgId($params);
         if ($orgId === null) { $this->_error('core.api.error.not_allowed'); return; }
@@ -267,7 +267,7 @@ public function deleteMenu(array $params): void
      */
     public function reorder(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('reorder')) { $this->_error('core.api.error.not_allowed'); return; }
         $menuKey = (string) ($params['menu_key'] ?? '');
         $orgId = $this->_scopedOrgId($params);
         if ($orgId === null) { $this->_error('core.api.error.not_allowed'); return; }
@@ -305,7 +305,7 @@ public function reorder(array $params): void
      */
     public function importFromTheme(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('importFromTheme')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $themeMenus = Tiger_Theme_Menus::all();
         if (!$themeMenus) { $this->_error('cms.menu.import_none'); return; }
@@ -362,7 +362,7 @@ protected function _importNodes(Tiger_Model_Menu $model, array $nodes, string $m
      */
     public function revertToTheme(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('revertToTheme')) { $this->_error('core.api.error.not_allowed'); return; }
         $menuKey = (string) ($params['menu_key'] ?? '');
         $orgId = $this->_scopedOrgId($params);
         if ($orgId === null) { $this->_error('core.api.error.not_allowed'); return; }
diff --git a/modules/cms/services/Page.php b/modules/cms/services/Page.php
index bbfb8669..64164744 100644
--- a/modules/cms/services/Page.php
+++ b/modules/cms/services/Page.php
@@ -29,7 +29,7 @@ class Cms_Service_Page extends Tiger_Service_Service
      */
     public function datatable(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('datatable')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $dt = $this->_dtParams($params);
 
@@ -48,8 +48,8 @@ public function datatable(array $params): void
 
         // Server-authoritative control permissions (per-caller, privilege-checked so
         // tightening save/delete in the ACL flows straight through to the buttons).
-        $canEdit   = $this->_isAdmin(static::class, 'save');
-        $canDelete = $this->_isAdmin(static::class, 'delete');
+        $canEdit   = $this->_isAllowed('save');
+        $canDelete = $this->_isAllowed('delete');
 
         $rows = [];
         foreach ($data['rows'] as $r) {
@@ -83,7 +83,7 @@ public function datatable(array $params): void
      */
     public function themeTemplates(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('themeTemplates')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $dt = $this->_dtParams($params);
 
@@ -137,7 +137,7 @@ public function themeTemplates(array $params): void
         // Paginate.
         $page = array_slice($rows, (int) $dt['start'], ((int) $dt['length'] > 0) ? (int) $dt['length'] : null);
 
-        $canEdit = $this->_isAdmin(static::class, 'save');
+        $canEdit = $this->_isAllowed('save');
         foreach ($page as &$r) { $r['can_edit'] = $canEdit; }
         unset($r);
 
@@ -172,7 +172,7 @@ protected function _forkedIndex(): array
      */
     public function forkTheme(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('forkTheme')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $kind = (string) ($params['kind'] ?? 'page');
         if (!in_array($kind, ['page', 'layout', 'partial'], true)) { $kind = 'page'; }
@@ -264,7 +264,7 @@ public function forkTheme(array $params): void
      */
     public function save(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('save')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $form = new Cms_Form_Page();
         if (!$form->isValid($params)) { $this->_formErrors($form); return; }
@@ -354,7 +354,7 @@ public function save(array $params): void
      */
     public function saveDesign(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('saveDesign')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $pageId = trim((string) ($params['page_id'] ?? ''));
         if ($pageId === '') { $this->_error('core.api.error.general'); return; }
@@ -423,7 +423,7 @@ public function saveDesign(array $params): void
      */
     public function saveBlock(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('saveBlock')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $name = trim((string) ($params['name'] ?? ''));
         if ($name === '') { $this->_error('cms.block.name_required'); return; }
@@ -478,7 +478,7 @@ protected function _uniqueKey(Tiger_Model_Page $pm, string $base): string
      */
     public function delete(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('delete')) { $this->_error('core.api.error.not_allowed'); return; }
         $id = !empty($params['page_id']) ? (string) $params['page_id'] : '';
         if ($id === '') { $this->_error('core.api.error.general'); return; }
 
@@ -498,7 +498,7 @@ public function delete(array $params): void
      */
     public function restore(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('restore')) { $this->_error('core.api.error.not_allowed'); return; }
         $id      = !empty($params['page_id']) ? (string) $params['page_id'] : '';
         $version = isset($params['version']) ? (int) $params['version'] : 0;
         if ($id === '' || $version < 1) { $this->_error('core.api.error.general'); return; }
diff --git a/modules/cms/services/Paths.php b/modules/cms/services/Paths.php
index fd4646f8..94834f09 100644
--- a/modules/cms/services/Paths.php
+++ b/modules/cms/services/Paths.php
@@ -31,7 +31,7 @@ class Cms_Service_Paths extends Tiger_Service_Service
      */
     public function search(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('search')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $q        = trim((string) ($params['q'] ?? ''));
         $advanced = !empty($params['advanced']) && (string) $params['advanced'] !== '0';
diff --git a/modules/cms/services/Settings.php b/modules/cms/services/Settings.php
index 55a00a28..47c4b142 100644
--- a/modules/cms/services/Settings.php
+++ b/modules/cms/services/Settings.php
@@ -22,7 +22,7 @@ class Cms_Service_Settings extends Tiger_Service_Service
      */
     public function save(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('save')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $form = new Cms_Form_Settings();
         if (!$form->isValid($params)) { $this->_formErrors($form); return; }
diff --git a/modules/mcp/services/Settings.php b/modules/mcp/services/Settings.php
index 5babaa26..7c30b3e4 100644
--- a/modules/mcp/services/Settings.php
+++ b/modules/mcp/services/Settings.php
@@ -19,7 +19,7 @@ class Mcp_Service_Settings extends Tiger_Service_Service
      */
     public function save(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('save')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $on = !empty($params['enabled']) && $params['enabled'] !== '0' && $params['enabled'] !== 'false';
         try {
@@ -39,7 +39,7 @@ public function save(array $params): void
      */
     public function mintToken(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('mintToken')) { $this->_error('core.api.error.not_allowed'); return; }
         $identity = Zend_Auth::getInstance()->getIdentity();
         $userId   = $identity->user_id ?? null;
         if ($userId === null) { $this->_error('core.api.error.login_required'); return; }
@@ -62,7 +62,7 @@ public function mintToken(array $params): void
     /** List the caller's MCP tokens with their scope (prefix + timestamps + modules/read_only/org_scoped). */
     public function tokens(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('tokens')) { $this->_error('core.api.error.not_allowed'); return; }
         $userId = Zend_Auth::getInstance()->getIdentity()->user_id ?? null;
         if ($userId === null) { $this->_error('core.api.error.login_required'); return; }
 
@@ -80,7 +80,7 @@ public function tokens(array $params): void
     /** Revoke one of the caller's tokens + drop its MCP policy. */
     public function revokeToken(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('revokeToken')) { $this->_error('core.api.error.not_allowed'); return; }
         $userId = Zend_Auth::getInstance()->getIdentity()->user_id ?? null;
         $id     = (string) ($params['credential_id'] ?? '');
         if ($userId === null || $id === '') { $this->_error('core.api.error.general'); return; }
diff --git a/modules/media/services/Media.php b/modules/media/services/Media.php
index d9d2e475..ac51b33b 100644
--- a/modules/media/services/Media.php
+++ b/modules/media/services/Media.php
@@ -22,7 +22,7 @@ class Media_Service_Media extends Tiger_Service_Service
      */
     public function upload(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('upload')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $file = isset($_FILES['file']) ? $_FILES['file'] : null;
         if (!$file || !is_uploaded_file((string) $file['tmp_name']) || $file['error'] !== UPLOAD_ERR_OK) {
@@ -126,7 +126,7 @@ public function upload(array $params): void
      */
     public function datatable(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('datatable')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $dt   = $this->_dtParams($params);
         $kinds = [Tiger_Model_Media::KIND_IMAGE, Tiger_Model_Media::KIND_DOCUMENT, Tiger_Model_Media::KIND_PDF,
@@ -173,7 +173,7 @@ public function datatable(array $params): void
             ])
             : ['rows' => [], 'total' => 0, 'filtered' => 0];
 
-        $canDelete = $this->_isAdmin(static::class, 'delete');
+        $canDelete = $this->_isAllowed('delete');
         $rows = [];
         foreach ($staticSlice as $e) { $rows[] = $this->_presentStatic($e); }
         if ($need > 0) {
@@ -197,7 +197,7 @@ public function datatable(array $params): void
      */
     public function copyToLibrary(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('copyToLibrary')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $src = Tiger_Media_Manifest::file((string) ($params['media_id'] ?? $params['ref'] ?? ''));
         if ($src === '') { $this->_error('media.error.static_missing'); return; }
@@ -306,7 +306,7 @@ protected function _presentStatic(array $e)
      */
     public function update(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('update')) { $this->_error('core.api.error.not_allowed'); return; }
         $id = (string) ($params['media_id'] ?? '');
         $model = new Tiger_Model_Media();
         // Ownership, not just role: the ACL says this caller is an admin, not that this row is theirs.
@@ -338,7 +338,7 @@ public function update(array $params): void
      */
     public function delete(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('delete')) { $this->_error('core.api.error.not_allowed'); return; }
         $id  = (string) ($params['media_id'] ?? '');
         $model = new Tiger_Model_Media();
         // Ownership FIRST — below this point the stored bytes are destroyed, which is not undoable by
diff --git a/modules/media/services/Settings.php b/modules/media/services/Settings.php
index b6cfc97f..c84509fe 100644
--- a/modules/media/services/Settings.php
+++ b/modules/media/services/Settings.php
@@ -43,7 +43,7 @@ class Media_Service_Settings extends Tiger_Service_Service
      */
     public function save(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('save')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $form = new Media_Form_Settings();
         if (!$form->isValid($params)) { $this->_formErrors($form); return; }
@@ -71,7 +71,7 @@ public function save(array $params): void
      */
     public function migrateDisk(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('migrateDisk')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $to   = preg_replace('/[^a-zA-Z0-9_-]/', '', (string) ($params['to'] ?? ''));
         $move = (string) ($params['move'] ?? '') === '1';
@@ -105,7 +105,7 @@ public function migrateDisk(array $params): void
      */
     public function saveStorage(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('saveStorage')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $adapter = $this->_storageAdapter($params);
         if ($adapter === null) { $this->_error('media.storage.bad_adapter'); return; }
@@ -157,7 +157,7 @@ public function saveStorage(array $params): void
      */
     public function testConnection(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('testConnection')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $settings = $this->_storageSettings($params);
         if ($settings === null) { $this->_error('media.storage.bad_adapter'); return; }
diff --git a/modules/register/services/Registration.php b/modules/register/services/Registration.php
index bd203a87..63266a73 100644
--- a/modules/register/services/Registration.php
+++ b/modules/register/services/Registration.php
@@ -30,7 +30,7 @@ public static function setTransport(?callable $t): void { self::$_transport = $t
     /** The current registration progress. @param array $params @return void */
     public function status(array $params): void
     {
-        if (!$this->_isAdmin('Register_AdminController')) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('status')) { $this->_error('core.api.error.not_allowed'); return; }
         $this->_success(['state' => Register_Service_Status::state()]);
     }
 
@@ -43,7 +43,7 @@ public function status(array $params): void
      */
     public function register(array $params): void
     {
-        if (!$this->_isAdmin('Register_AdminController')) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('register')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $form = new Register_Form_Register();
         if (!$form->isValid($params)) { $this->_formErrors($form); return; }
@@ -79,7 +79,7 @@ public function register(array $params): void
     /** (Re)confirm domain control via the registry. @param array $params @return void */
     public function verifyDomain(array $params): void
     {
-        if (!$this->_isAdmin('Register_AdminController')) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('verifyDomain')) { $this->_error('core.api.error.not_allowed'); return; }
         if (!Register_Service_Status::hasStarted()) { $this->_error('register.error.not_registered'); return; }
         $this->_selfVerifyDomain();
         $verified = Register_Service_Status::isDomainVerified();
@@ -89,7 +89,7 @@ public function verifyDomain(array $params): void
     /** Resend the admin email verification link. @param array $params @return void */
     public function resendEmail(array $params): void
     {
-        if (!$this->_isAdmin('Register_AdminController')) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('resendEmail')) { $this->_error('core.api.error.not_allowed'); return; }
         $email = (string) (new Tiger_Model_Config())->get(Tiger_Model_Config::SCOPE_GLOBAL, '', 'register.email');
         if ($email === '') { $this->_error('register.error.not_registered'); return; }
         $this->_issueEmailToken($email, (string) (new Tiger_Model_Config())->get(Tiger_Model_Config::SCOPE_GLOBAL, '', 'register.domain'));
diff --git a/modules/seo/services/Social.php b/modules/seo/services/Social.php
index 460dd66b..be56a619 100644
--- a/modules/seo/services/Social.php
+++ b/modules/seo/services/Social.php
@@ -48,7 +48,7 @@ class Seo_Service_Social extends Tiger_Service_Service
      */
     public function pages(array $params): void
     {
-        if (!$this->_isAdmin()) {
+        if (!$this->_isAllowed('pages')) {
             $this->_error('core.api.error.not_allowed');
             return;
         }
@@ -88,7 +88,7 @@ public function pages(array $params): void
      */
     public function save(array $params): void
     {
-        if (!$this->_isAdmin()) {
+        if (!$this->_isAllowed('save')) {
             $this->_error('core.api.error.not_allowed');
             return;
         }
diff --git a/modules/sms/services/Settings.php b/modules/sms/services/Settings.php
index 99c35a92..46c5eb90 100644
--- a/modules/sms/services/Settings.php
+++ b/modules/sms/services/Settings.php
@@ -18,7 +18,7 @@ class Sms_Service_Settings extends Tiger_Service_Service
      */
     public function save(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('save')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $provider = strtolower(trim((string) ($params['provider'] ?? '')));
         if ($provider !== '' && !in_array($provider, Tiger_Sms::providers(), true)) {
@@ -60,7 +60,7 @@ public function save(array $params): void
      */
     public function test(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('test')) { $this->_error('core.api.error.not_allowed'); return; }
         $to  = (string) ($params['to'] ?? '');
         $msg = trim((string) ($params['message'] ?? '')) ?: 'Tiger SMS test message.';
         if ($to === '') { $this->_error('sms.settings.error.to'); return; }