Protect owner administration authority

access/access.go

@@ -19,6 +19,7 @@ import (
 
 var (
 	ErrLastOwner          = errors.New("access: the last active direct owner must be preserved")
+	ErrOwnerAuthority     = errors.New("access: a current direct owner must approve owner role changes")
 	ErrRoleChangeConflict = errors.New("access: role binding changed")
 	ErrRoleUnchanged      = errors.New("access: role is unchanged")
 	idPattern             = regexp.MustCompile(`^[A-Za-z0-9_-]{8,128}$`)
@@ -218,8 +219,9 @@ type OrganizationUserRoleChange struct {
 // ReplaceOrganizationUserRole atomically replaces every current direct,
 // organization-wide role for one active member with exactly one role. The
 // expected binding IDs make concurrent administration fail closed. When an
-// owner role is configured, the repository also protects the final active
-// direct owner in the same transaction.
+// owner role is configured, the repository also requires a current active
+// direct owner for any change to or from that role and protects the final
+// active direct owner in the same transaction.
 func (service *Service) ReplaceOrganizationUserRole(ctx context.Context, input OrganizationUserRoleChange) (Binding, error) {
 	if service.ownerRole == "" {
 		return Binding{}, errors.New("access: owner role is required for role replacement")