## Problem Follow-up to: #3586294+s Parent: #3586310+s `AiContextUsageRecordController` renders the full current content of the referenced context item via the entity view builder with no `access('view')` check. The route only requires `view ai context usage`, so a user with that permission alone can read the content of items they cannot view — notably items unpublished since the usage was recorded (viewing those requires `view any unpublished ai context item` or ownership). The same page also exposes affordances without matching access: - The context item label is disclosed via `toLink()` in the summary table. - The agent field always links to the context agent edit form (`administer ai context`), even for usage-only viewers. - The target entity field checks `access('view')` but did not use a consistent `(no access)` fallback when access is denied. This breaks the module's privilege separation between usage viewers and context administrators. ## Proposed resolution - Gate context item `toLink()` and the "Context item content (current)" section on `$context_item->access('view')`, with a `Context item @id (no access)` fallback. - Gate the agent field on route access to `ai_context.settings.agent_edit`; show plain text when denied. Apply the same check in the usage listing `AgentLinkField` views handler; bubble access cacheability on both allowed and denied branches. - Gate the usage listing context item column the same way via `ContextItemLinkField` (`Context item @id (no access)` fallback). - Show `@type:@id (no access)` for target entities that exist but cannot be viewed; keep plain `@type:@id` when the entity cannot be loaded. - Bubble access-result cacheability on the usage record page (context item, target entity, and agent route checks). - Add `cachePerUser()` to unpublished item view checks when `view ai context items` is held, since access depends on ownership. - Gate the "Add subcontext" list operation on create access. - Add `AiContextUsageRecordAccessTest` covering unpublished/published context items, agent link access (record page and usage listing), context item column access on the usage listing, target entity fallback (including missing entity), and owner-based cache bubbling. - Add `AiContextItemListTest` coverage for "Add subcontext" create access. MR: !208 ## AI usage - [x] AI assisted issue