feat: deliver Xingbang four-agent v2 workspace

backend/api/risk_agent_access.py

@@ -30,10 +30,12 @@ def authorize(request: Request):
     request.state.identity = user
     path = request.url.path.split("/risk-agent/", 1)[-1]
     if user["role"] == "manager":
-        permitted = path in ("catalog", "access/context", "runs/history") or (path.startswith("plans/") and path.endswith("/run"))
+        permitted = path in ("catalog", "access/context", "runs/history") or (path.startswith("plans/") and path.endswith("/run")) or (path.startswith("reports/") and request.method=="GET")
+        permitted = permitted or (path.startswith("coordination/") and (request.method == "GET" or path.endswith("/actions")))
+        permitted = permitted or (path.startswith(("collateral/", "workspace/")) and request.method == "GET")
         if not permitted:
             raise HTTPException(403, "客户经理无权管理配置")
-    if user["role"] == "reviewer" and request.method != "GET" and not path.endswith("/review"):
+    if user["role"] == "reviewer" and request.method != "GET" and not path.endswith("/review") and not path.startswith(("reports/", "coordination/", "collateral/")):
         raise HTTPException(403, "审核员仅可审核发布，不能修改配置或执行查询")