The agency decides who gets the 3D builder

Organizations.builder3d_enabled is the agency grant; organizations.estimate_engine is the tenant's choice. The grant decides whether the CHOICE exists — it never makes the choice. The effective engine is derived at read time, so a revoke does not rewrite the tenant's preference and a re-grant restores exactly what they had.

Also called: builder access · estimate engine · switch from SmartBuild · who can use the builder

1. 1The /3d-builder page is Clerk-walled by the middleware default and then checks the grant, redirecting an ungranted account to the app rather than showing a not-allowed screen — they were never offered the builder anywhere in their UI, so the honest answer is 'this isn't part of your account'.
2. 2The server clamps the engine to SmartBuild for an ungranted org, so every internal-estimate branch across Estimates, Contacts and Pipeline simply does not render — the grant is enforced in ONE place and lands everywhere.
3. 3The client hook exposes `allowed` separately so surfaces that OFFER the choice (the engine picker, the 3D Builder nav link, the Builder-prices and Materials settings tabs) hide themselves rather than dangle a control that 403s.
4. 4Both layers fail CLOSED: an unreadable org row resolves to not-granted, which is the state every tenant is already in.
5. 5No cache on the server read, for the same reason the comms gate has none: a cached grant means a revoke does not take effect for the life of the cache.
6. 6The last known state is cached client-side only so the first frame paints the right path, and a cached engine is only honoured alongside a cached grant.

• ◆Rolling out a new estimating engine without stranding existing SmartBuild work.
• ◆Access controls scattered across every surface that renders an engine-specific branch.