ML Data Manager role can't fetch job tasks via API

[mihow]

Problem

When an ML worker (ami-data-companion) authenticates with a user that has the ML Data Manager role on a project, it gets a 403 Forbidden when trying to fetch job tasks:

GET /api/v2/jobs/{id}/tasks/?batch=16&processing_service_name=...
→ 403 Forbidden

The worker can successfully:

• Authenticate and get a token (/auth/token/login/)
• Register pipelines (ami worker register)
• Poll for and claim jobs

But it cannot fetch tasks for the claimed job.

Context

Discovered while setting up a worker (cpu-1) to process jobs on the demo environment. The processingservice-01 user had ML Data Manager role on both demo projects. Making the user a superuser resolved the issue as a workaround.

Expected Behavior

A non-superuser role (ML Data Manager, or a dedicated processing service role) should have sufficient permissions to:

• Poll for jobs
• Claim jobs
• Fetch job tasks
• Post results

Workaround

Grant superuser status to the processing service user.

[mihow]

Claude says: Closing as a duplicate of #1263, which is the broader audit of the same root cause: the tasks_ml_job / result_ml_job object-level permissions are not registered, so non-superusers — including the ML Data Manager role — get a 403 on /tasks and /result. The fix is tracked there (gated on the API-key auth work in #1194).