Public designation autofill is not access control

In GiveCampus giving forms, available controls depend on your permissions and the interface used by your institution.

Anyone with a public form URL can edit supported designation preselection parameters. They are donor inputs, not administrator permissions. The resolver searches form-attached designation nodes and does not apply a simple visible-only filter. Obscuring a URL or merely hiding a fund is not a reliable restriction. Review actual attached/eligible funds and use a separately restricted experience if public selection must be prevented.