Each one is a service that passes its tests and still fails in production. Pick one.
After one odd request, every user had admin rights. The visible tests pass. Work out what production does that the tests do not.
A settings update changes only the account being updated, never global state or other accounts.
No request body can grant an account admin access it was not given.
Existing nested settings still merge instead of being replaced wholesale.
A genuine admin keeps their admin access.
An ordinary account stays ordinary after a normal settings update.