[Due for payment 2026-09-03] Copilot can open and submit Close account for the account they act on

[lakchote]

Summary

A copilot acting on another person's account can open Settings > Security > Close account and submit the form. The request is doomed as Auth rejects CloseAccount from delegate tokens, so the copilot hits a dead end.

Issue Owner

Current Issue Owner: @mallenexpensify

[melvin-bot]

@lakchote

The solution for this issue has been 🚀 deployed to production 🚀 in version 9.4.62-4 and is now subject to a 7-day regression period 📆. Here is the list of pull requests that resolve this issue:

• Gate close account for copilots #99400

If no regressions arise, payment will be issued on 2026-09-03. 🎊

The following checklist (instructions) will need to be completed before the issue can be closed. Please copy/paste the Contributor+ Checklist from here into a new comment on this GH and complete it. If you have the K2 extension, you can simply click: [this button]. If no checklist is needed for this issue, you can click: [no checklist button]

[dmkt9]

Contributor+ Checklist:

• [Contributor] The offending PR and associated issue have been commented on, pointing out the bug it caused and why, so the author and reviewers can learn from the mistake.

  Link to the comment on the PR: N/A (improvement)

• [Contributor] If the regression was CRITICAL (e.g. interrupts a core flow) A discussion in #expensify-open-source has been started about whether any other steps should be taken (e.g. updating the PR review checklist) in order to catch this type of bug sooner.

  Link to discussion: N/A

• [Contributor] If it was decided to create a regression test for the bug, please propose the regression test steps using the template below to ensure the same bug will not reach production again.

Regression Test Proposal

Test:

1. Sign in as account A, which owns at least one workspace, and give account B full copilot access.
2. Sign in as account B and switch into account A.
3. Open Settings > Security and tap Close account.
4. Verify the copilot no-access modal appears and the close form never opens.

Do we agree 👍 or 👎