{
  "feature_id": "F-105",
  "agent": "security",
  "verdict": "APPROVED",
  "summary": "Preference writes are authenticated, owner-scoped and strictly validated; SQL stays parameterized.",
  "evidence": [
    "PATCH /users/:id keeps requireOwnerOrAdmin guard",
    "zod strict schema allows only three boolean keys; unknown keys rejected",
    "preferences merged via COALESCE(preferences,'{}')||$n::jsonb parameterized query",
    "No secret or PII exposure added"
  ],
  "timestamp": "2026-08-21T06:20:30Z"
}