Overview

The internal-cluster-action gates in initializeOperationSessionInfo (src/mongo/db/initialize_operation_session_info.cpp) currently use ErrorCodes::InvalidOptions. They should use ErrorCodes::Unauthorized — the semantic intent is "user lacks the privilege to send this option," not "the option is malformed."

Acceptance Criteria

• The internal-cluster-action uasserts in initializeOperationSessionInfo throw ErrorCodes::Unauthorized.
• Adjust any C++ unit tests that pin the error code if needed.