docs(quotes): document that quote create and execute require TRANSACT

openapi/paths/quotes/quotes.yaml

@@ -17,6 +17,10 @@ post:
 
     **Important:** If you are transferring funds in the same currency (no exchange required),
     use the `/transfer-in` or `/transfer-out` endpoints instead.
+
+    Requires a token with the `TRANSACT` permission; `VIEW` alone is not
+    sufficient. A quote is the instrument a later execute draws on, and
+    `immediatelyExecute` moves funds within this same request.
   operationId: createQuote
   tags:
     - Cross-Currency Transfers
@@ -141,7 +145,9 @@ post:
           schema:
             $ref: ../../components/schemas/errors/Error401.yaml
     '403':
-      description: Customer has not accepted the End User Terms
+      description: >-
+        Forbidden. The token lacks the `TRANSACT` permission, or the customer has
+        not accepted the End User Terms.
       content:
         application/json:
           schema:

openapi/paths/quotes/quotes_{quoteId}_execute.yaml

@@ -14,6 +14,12 @@ post:
     session private key of a verified authentication credential on the source
     Embedded Wallet.
 
+    Requires a token with the `TRANSACT` permission; `VIEW` alone is not
+    sufficient to release a transfer. On an `EMBEDDED_WALLET` source this is in
+    addition to the `Grid-Wallet-Signature` header: the signature proves the
+    wallet holder authorized the payment, while `TRANSACT` is what authorizes
+    your integration to release it.
+
     Once executed, the quote cannot be cancelled and the transfer will be processed.
   operationId: executeQuote
   tags:
@@ -95,6 +101,12 @@ post:
         application/json:
           schema:
             $ref: ../../components/schemas/errors/Error401.yaml
+    '403':
+      description: Forbidden. The token lacks the `TRANSACT` permission.
+      content:
+        application/json:
+          schema:
+            $ref: ../../components/schemas/errors/Error403.yaml
     '404':
       description: Quote not found
       content: