- name: orders-write-permission
  where: "orders-plugin.cjs"
  ensure: >-
    The preHandler must reject an authenticated actor that lacks orders:write before allowing the cancellation route.