Agent-System/.doc/audit/authorization-matrix-v3-full.md

title, created, updated, status

title	created	updated	status
Authorization matrix v3 — full route inventory	2026-09-16	2026-09-16	done

Authorization matrix v3 — full route inventory

Generated from mux.HandleFunc registrations under internal/server/. AuthN column is heuristic; negative-test pointers filled where known.

Method	Path	Handler	File	AuthN (heuristic)	Neg test
GET	/	s.serveSPA	server.go	handler	see suite
GET	/api/v1/admin/config	s.handleAdminConfig	server.go	admin+project?	see suite
PUT	/api/v1/admin/config	s.handleAdminConfig	server.go	admin+project?	see suite
GET	/api/v1/admin/permissions	s.handleAdminPermissions	server.go	admin+project?	see suite
GET	/api/v1/admin/roles	s.handleAdminRoles	server.go	admin+project?	see suite
POST	/api/v1/admin/roles	s.handleAdminRoles	server.go	admin+project?	see suite
DELETE	/api/v1/admin/roles/{id}	s.handleAdminRoleByID	server.go	admin+project?	see suite
PATCH	/api/v1/admin/roles/{id}	s.handleAdminRoleByID	server.go	admin+project?	see suite
GET	/api/v1/admin/templates	s.handleAdminTemplates	server.go	admin+project?	see suite
POST	/api/v1/admin/templates	s.handleAdminTemplates	server.go	admin+project?	see suite
GET	/api/v1/admin/templates/{key}/versions	s.handleAdminTemplateVersions	server.go	admin+project?	see suite
GET	/api/v1/admin/users	s.handleAdminUsers	server.go	admin+project?	see suite
POST	/api/v1/admin/users	s.handleAdminUsers	server.go	admin+project?	see suite
PUT	/api/v1/admin/users/{id}/role	s.handleAdminUpdateRole	server.go	admin+project?	see suite
PUT	/api/v1/admin/users/{id}/status	s.handleAdminUpdateStatus	server.go	admin+project?	see suite
GET	/api/v1/admin/workflows	s.handleAdminWorkflows	server.go	admin+project?	see suite
POST	/api/v1/admin/workflows	s.handleAdminWorkflows	server.go	admin+project?	see suite
GET	/api/v1/admin/workflows/{id}	s.handleAdminWorkflowByID	server.go	admin+project?	see suite
PATCH	/api/v1/admin/workflows/{id}/versions/{version}	s.handleAdminWorkflowVersion	server.go	admin+project?	see suite
POST	/api/v1/admin/workflows/{id}/versions/{version}/publish	s.handleAdminWorkflowPublish	server.go	admin+project?	see suite
POST	/api/v1/admin/workflows/{id}/versions/{version}/retire	s.handleAdminWorkflowRetire	server.go	admin+project?	see suite
POST	/api/v1/admin/workflows/{id}/versions/{version}/validate	s.handleAdminWorkflowValidate	server.go	admin+project?	see suite
POST	/api/v1/admin/workspaces/reconcile	s.handleReconcileWorkspace	server.go	admin+project?	see suite
POST	/api/v1/auth/change-password	s.handleAuthChangePassword	server.go	handler	see suite
POST	/api/v1/auth/login	s.handleAuthLogin	server.go	handler	see suite
POST	/api/v1/auth/logout	s.handleAuthLogout	server.go	handler	see suite
GET	/api/v1/auth/me	s.handleAuthMe	server.go	handler	see suite
GET	/api/v1/auth/public-config	s.handleAuthPublicConfig	server.go	handler	see suite
POST	/api/v1/auth/register	s.handleAuthRegister	server.go	handler	see suite
GET	/api/v1/auth/sessions	s.handleAuthSessions	server.go	handler	see suite
DELETE	/api/v1/auth/sessions/{id}	s.handleAuthSessionByID	server.go	handler	see suite
POST	/api/v1/chat	s.handleChat	server.go	session+project	see suite
GET	/api/v1/chat/categories	s.handleListChatCategories	server.go	session+project	see suite
GET	/api/v1/chat/dates	s.handleListChatDates	server.go	session+project	see suite
GET	/api/v1/chat/digests	s.handleListDailyDigests	server.go	session+project	see suite
POST	/api/v1/chat/digests/generate	s.handleGenerateDailyDigest	server.go	session+project	see suite
GET	/api/v1/chat/export/messages	s.handleChatExportMessages	server.go	session+project	see suite
GET	/api/v1/chat/messages	s.handleGetChatMessages	server.go	session+project	see suite
GET	/api/v1/chat/messages/day	s.handleGetChatDayMessages	server.go	session+project	see suite
POST	/api/v1/chat/messages/import	s.handleImportChatMessages	server.go	session+project	see suite
GET	/api/v1/chat/messages/window	s.handleGetChatWindow	server.go	session+project	see suite
GET	/api/v1/chat/messages/{message_id}/export-capability	s.handleGetExportCapability	server.go	session+project	see suite
GET	/api/v1/chat/messages/{message_id}/export-source	s.handleGetExportSource	server.go	session+project	see suite
POST	/api/v1/chat/read	s.handleChatRead	server.go	session+project	see suite
POST	/api/v1/chat/recategorize	s.handleChatRecategorize	server.go	session+project	see suite
GET	/api/v1/chat/search	s.handleChatSearch	server.go	session+project	see suite
GET	/api/v1/chat/sessions	s.handleListChatSessions	server.go	session+project	see suite
POST	/api/v1/chat/sessions	s.handleUpsertChatSession	server.go	session+project	see suite
GET	/api/v1/chat/stream	s.handleChatStream	server.go	session+project	see suite
POST	/api/v1/chat/stream	s.handleChatStream	server.go	session+project	see suite
GET	/api/v1/chat/turns/{client_turn_id}	s.handleGetChatTurn	server.go	session+project	see suite
GET	/api/v1/chat/unread	s.handleChatUnread	server.go	session+project	see suite
GET	/api/v1/context/cases/recommend	s.handleRecommendCases	server.go	handler	see suite
GET	/api/v1/context/project	s.handleGetProjectContext	server.go	handler	see suite
GET	/api/v1/context/user	s.handleGetUserContext	server.go	handler	see suite
PUT	/api/v1/context/user/preference	s.handleUpdateUserPreference	server.go	handler	see suite
POST	/api/v1/docgov/approver-decision	s.handleDocGovApproverDecision	server.go	handler	see suite
GET	/api/v1/docgov/audit-logs	s.handleDocGovListAuditLogs	server.go	handler	see suite
POST	/api/v1/docgov/claim	s.handleDocGovClaim	server.go	handler	see suite
GET	/api/v1/docgov/comments	s.handleDocGovListComments	server.go	handler	see suite
POST	/api/v1/docgov/comments	s.handleDocGovAddComment	server.go	handler	see suite
POST	/api/v1/docgov/content	s.handleDocGovSaveContent	server.go	handler	see suite
GET	/api/v1/docgov/document	s.handleDocGovGetDocument	server.go	handler	see suite
GET	/api/v1/docgov/documents/{doc_id}/content	s.handleDocGovGetDocumentContent	server.go	session+project	see suite
POST	/api/v1/docgov/lease/acquire	s.handleDocGovAcquireLease	server.go	handler	see suite
POST	/api/v1/docgov/lease/heartbeat	s.handleDocGovHeartbeatLease	server.go	handler	see suite
POST	/api/v1/docgov/lease/release	s.handleDocGovReleaseLease	server.go	handler	see suite
POST	/api/v1/docgov/proposal/decide	s.handleDocGovDecideProposal	server.go	handler	see suite
POST	/api/v1/docgov/review-decision	s.handleDocGovReviewDecision	server.go	handler	see suite
POST	/api/v1/docgov/submit-review	s.handleDocGovSubmitReview	server.go	handler	see suite
GET	/api/v1/documents/{doc_id}/agent-candidates/{candidate_id}	s.handleDocRevisionGetCandidate	document_revision_handlers.go	session+project	see suite
POST	/api/v1/documents/{doc_id}/agent-candidates/{candidate_id}/decision	s.handleDocRevisionCandidateDecision	document_revision_handlers.go	session+project	see suite
GET	/api/v1/documents/{doc_id}/change-reports/{report_id}	s.handleDocRevisionGetReport	document_revision_handlers.go	session+project	see suite
PATCH	/api/v1/documents/{doc_id}/content	s.handleDocRevisionPatchContent	document_revision_handlers.go	session+project	see suite
GET	/api/v1/documents/{doc_id}/diff	s.handleDocRevisionDiff	document_revision_handlers.go	session+project	see suite
GET	/api/v1/documents/{doc_id}/manual-overlay	s.handleDocRevisionManualOverlay	document_revision_handlers.go	session+project	see suite
GET	/api/v1/documents/{doc_id}/revision-state	s.handleDocRevisionState	document_revision_handlers.go	session+project	see suite
GET	/api/v1/documents/{doc_id}/versions	s.handleDocRevisionListVersions	document_revision_handlers.go	session+project	see suite
GET	/api/v1/documents/{doc_id}/versions/{version_no}	s.handleDocRevisionGetVersion	document_revision_handlers.go	session+project	see suite
GET	/api/v1/freeform-documents	s.handleListFreeformDocs	server.go	session+project	see suite
POST	/api/v1/freeform-documents	s.handleCreateFreeformDoc	server.go	session+project	see suite
POST	/api/v1/freeform-documents/from-message	s.handleCreateFreeformDocFromMessage	server.go	session+project	see suite
DELETE	/api/v1/freeform-documents/{doc_id}	s.handleDeleteFreeformDoc	server.go	session+project	see suite
GET	/api/v1/freeform-documents/{doc_id}	s.handleGetFreeformDoc	server.go	session+project	see suite
PUT	/api/v1/freeform-documents/{doc_id}	s.handleUpdateFreeformDoc	server.go	session+project	see suite
POST	/api/v1/freeform-documents/{doc_id}/share	s.handleShareFreeformDoc	server.go	session+project	see suite
POST	/api/v1/freeform-documents/{doc_id}/unshare	s.handleUnshareFreeformDoc	server.go	session+project	see suite
GET	/api/v1/health	s.handleHealth	server.go	public	see suite
GET	/api/v1/me/preferences	s.handleMePreferences	server.go	handler	see suite
PUT	/api/v1/me/preferences	s.handleMePreferences	server.go	handler	see suite
GET	/api/v1/me/profile	s.handleMeProfile	server.go	handler	see suite
PATCH	/api/v1/me/profile	s.handleMeProfile	server.go	handler	see suite
PATCH	/api/v1/notifications/{id}	s.handlePatchNotification	document_revision_handlers.go	handler	see suite
GET	/api/v1/projects	s.handleListProjects	server.go	session+project	see suite
POST	/api/v1/projects	s.handleCreateProject	server.go	session+project	see suite
GET	/api/v1/projects/{id}	s.handleGetProjectByID	server.go	session+project	see suite
POST	/api/v1/projects/{id}/activation-preview	s.handleActivationPreview	server.go	session+project	see suite
PUT	/api/v1/projects/{id}/active-workflow	s.handleActivateWorkflow	server.go	session+project	see suite
GET	/api/v1/projects/{id}/assets	s.handleListProjectAssets	server.go	session+project	see suite
POST	/api/v1/projects/{id}/assets	s.handleUploadProjectAsset	server.go	session+project	see suite
GET	/api/v1/projects/{id}/documents	s.handleListProjectWorkflowDocuments	server.go	session+project	see suite
GET	/api/v1/projects/{id}/lineage	s.handleGetProjectLineage	server.go	session+project	see suite
DELETE	/api/v1/projects/{id}/members	s.handleProjectMembers	server.go	session+project	see suite
GET	/api/v1/projects/{id}/members	s.handleProjectMembers	server.go	session+project	see suite
POST	/api/v1/projects/{id}/members	s.handleProjectMembers	server.go	session+project	see suite
PUT	/api/v1/projects/{id}/members	s.handleProjectMembers	server.go	session+project	see suite
GET	/api/v1/projects/{id}/notifications	s.handleListProjectNotifications	server.go	session+project	see suite
GET	/api/v1/projects/{id}/settings	s.handleGetProjectSettings	server.go	session+project	see suite
POST	/api/v1/projects/{id}/workflow-instances/activate	s.handleActivateWorkflowInstance	server.go	session+project	see suite
PUT	/api/v1/projects/{id}/workflow-plan	s.handleSaveWorkflowPlan	server.go	session+project	see suite
GET	/api/v1/projects/{id}/workflow-plan/default	s.handleGetDefaultWorkflowPlan	server.go	session+project	see suite
GET	/api/v1/projects/{id}/workflows	s.handleListProjectWorkflows	server.go	session+project	see suite
POST	/api/v1/projects/{id}/workflows/{workflow_key}/run	s.handleRunProjectWorkflow	server.go	session+project	see suite
GET	/api/v1/projects/{id}/workflows/{workflow_key}/runs	s.handleListProjectWorkflowRuns	server.go	session+project	see suite
GET	/api/v1/ready	s.handleReadiness	server.go	public	see suite
POST	/api/v1/tasks/run	s.handleRunTask	server.go	session+project	see suite
GET	/api/v1/tasks/run/stream	s.handleRunTaskStream	server.go	session+project	see suite
POST	/api/v1/tasks/run/stream	s.handleRunTaskStream	server.go	session+project	see suite
POST	/api/v1/tasks/runs	s.handleCreateTaskRun	server.go	session+project	see suite
GET	/api/v1/tasks/runs/{run_id}	s.handleGetTaskRun	server.go	session+project	see suite
POST	/api/v1/tasks/runs/{run_id}/cancel	s.handleCancelTaskRun	server.go	session+project	see suite
GET	/api/v1/tasks/runs/{run_id}/events	s.handleTaskRunEvents	server.go	session+project	see suite
POST	/api/v1/tasks/runs/{run_id}/resume	s.handleResumeTaskRun	server.go	session+project	see suite
GET	/api/v1/workflow-instances/{id}	s.handleGetWorkflowInstance	server.go	session+project	see suite
POST	/api/v1/workflow-instances/{id}/stages/{stage}/advance	s.handleAdvanceStage	server.go	session+project	see suite
GET	/api/v1/workflow-instances/{id}/stages/{stage}/readiness	s.handleGetStageReadiness	server.go	session+project	see suite
POST	/api/v1/workflow-instances/{id}/terminate	s.handleTerminateWorkflowInstance	server.go	session+project	see suite
GET	/api/v1/workflow-instances/{id}/termination-preview	s.handleTerminationPreview	server.go	session+project	see suite
GET	/api/v1/workflows	s.handleListWorkflowDefinitions	server.go	session+project	see suite
GET	/api/v1/workflows/catalog	s.handleWorkflowCatalog	server.go	session+project	see suite
GET	/health	s.handleHealth	server.go	public	see suite
GET	/ready	s.handleReadiness	server.go	public	see suite
*	/sse	func(w http.ResponseWriter, r *http.Request	task_run_idempotent_sse_test.go	handler	see suite

Total routes: 133

Session interrupt fail-closed

When IAM/auth store unavailable after session established, protected reads must reject (see TestAuthStore_SessionInterruptFailClosed).

BUG-11 410 policy

Product decision 2026-09-16: retain WORKFLOW_SWITCH_API_RETIRED 410 when governance available; legacy path only when governance unavailable. Not a capability gap.