Request body for PUT /api/teams/{id}/public-within-policy: true forbids every public_within row over this team and every team beneath it; false clears this team's forbid (a forbid set higher up still holds). On the root (temper-system) it is the instance-wide off, and only a system admin sets it.