feat(master-data): scope detail reads to resource overview

packages/api/src/router/assistant.ts

@@ -236,6 +236,12 @@ const PLANNING_READ_TOOLS = new Set([
   "find_best_project_resource",
 ]);
 
+/** Tools that require broad people-directory visibility because the backing routes expose resource-linked counts. */
+const RESOURCE_OVERVIEW_TOOLS = new Set([
+  "get_country",
+  "list_org_units",
+]);
+
 /** Tools that follow controllerProcedure access rules in the main API. */
 const CONTROLLER_ONLY_TOOLS = new Set([
   "search_projects",
@@ -363,6 +369,8 @@ export function getAvailableAssistantTools(permissions: Set<PermissionKey>, user
   return TOOL_DEFINITIONS.filter((tool) => {
     const toolName = tool.function.name;
     const requiredPerm = TOOL_PERMISSION_MAP[toolName];
+    const hasResourceOverviewAccess = permissions.has(PermissionKey.VIEW_ALL_RESOURCES)
+      || permissions.has(PermissionKey.MANAGE_RESOURCES);
     const hasControllerAccess = userRole === SystemRole.ADMIN
       || userRole === SystemRole.MANAGER
       || userRole === SystemRole.CONTROLLER;
@@ -378,6 +386,9 @@ export function getAvailableAssistantTools(permissions: Set<PermissionKey>, user
     if (MANAGER_ONLY_TOOLS.has(toolName) && !hasManagerAccess) {
       return false;
     }
+    if (RESOURCE_OVERVIEW_TOOLS.has(toolName) && !hasResourceOverviewAccess) {
+      return false;
+    }
     if (CONTROLLER_ONLY_TOOLS.has(toolName) && !hasControllerAccess) {
       return false;
     }