True, though that wouldn't restrict malicious actors from being able to edit via the API if they wanted to (as documented e.g. at https://we.phorge.it/book/phorge/article/forms/#use-case-security-issues:~:text=regardless%20of,Conduit%20API).

Another idea might be to restrict what forms you can use to edit. I think you could allow claiming a task that way while disallowing some other edits.

note to self: one thing is that this would appear to prevent non-members of Task-Editors from claiming tasks as well (which might in turn mean that new developers then couldn’t assign a task to themselves)

(this _test2 account is not currently in the #pseudo-trusted-contributors project)