feat(access-requests): remove rollout flag and move feature into ee

[waleedlatif1]

Summary

• Remove the permission-access-requests feature flag and PERMISSION_ACCESS_REQUESTS_ENABLED. Access requests are now on for every entitled organization (Enterprise on hosted, access control enabled when self-hosted), and the org-level "Allow users to request permissions" opt-out is the only remaining switch
• Drop the flag's threading through prepareAccessRequestPolicy / isAccessRequestEnabled and the flag-only tests
• Move the feature into apps/sim/ee/access-requests/: lib/ (was lib/permission-access-requests + lib/permission-groups/access-requests/targets), components/ (was components/access-requests), hooks/ (was hooks/queries/access-requests + access-request-keys). Contracts, routes, and pages stay put
• README moved to ee/access-requests/README.md, feature listed in ee/README.md

Type of Change

• New feature

Testing

• bun run type-check, bun run lint, check:audits (all green), docs-manifest:check
• Vitest across ee/access-requests, ee/access-control, settings, outbox, workspace app: 5,006 passing
• Companion infra PR makes the integ availability probe fail (not skip) if discovery ever reports access requests off for the Enterprise fixture org

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 18, 2026 9:54pm UTC

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge with no actionable behavioral, security, build, or repository-rule violations identified.

Summary

This PR removes the separate access-request rollout switch and consolidates the feature under apps/sim/ee/access-requests, while preserving its typed routes, authorization boundary, organization opt-out, entitlement checks, query behavior, and outbox notifications.

• Hosted access requests now follow the organization’s Enterprise entitlement.
• Self-hosted access requests follow the Access Control entitlement, including the enterprise master switch.
• Organization administrators retain the sole opt-out through “Allow users to request permissions.”
• Product surfaces, API routes, prefetching, tests, and outbox processing now import the consolidated enterprise implementation.
• The removed environment variable and feature-flag identifier have no remaining live callers or deployment references.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Surface[Workspace or organization surface] --> Discovery[Access-request discovery]
  Discovery --> OptOut{Organization allows requests?}
  OptOut -->|No| Unavailable[Requests unavailable]
  OptOut -->|Yes| Entitlement{Deployment entitlement}
  Entitlement -->|Hosted| Enterprise[Enterprise organization]
  Entitlement -->|Self-hosted| AccessControl[Access Control enabled]
  Enterprise --> Policy[Evaluate current permission policy]
  AccessControl --> Policy
  Policy -->|Restricted| Request[Create access request]
  Policy -->|Allowed| Granted[Access already available]
  Request --> Review[Organization administrator review]
  Review -->|Apply| Update[Update permission group or credit limit]
  Review -->|Decline| Declined[Decline request]
  Update --> Outbox[Outbox notification and audit]
  Declined --> Outbox

Loading

_{Reviews (1) · Last reviewed commit: "feat(access-requests): remove rollout fl..."}

[cubic-dev-ai]

No issues found across 103 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}