gplay-orders

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill provides the capability to process refunds via gplay orders refund, which is a direct financial operation. Access control is established through documented API permissions and role-based permissions (CAN_MANAGE_ORDERS), evaluated and enforced by the service API (returning a 403 on failure).