Settings mutations are restricted to tenant admins

Unauthenticated request. These routes are intentionally tenant-admin-only in Phase 8 so platform and support actors are not conflated with tenant administration.