, and evaluated unconditionally on every request before any auth logic runs.

Enforced by: → loopback host check
Bypass: None — not overridable by JWT, CLI token, or

Response on violation:

Enforced by: → skip bypass
Bypass: None when ; JWT always required

Response on violation:

is configured. CLI tokens can authenticate these routes (loopback + valid HMAC).

in
1. asserting that returns true for the new prefix
2. Never skip this step — see Hard Rule #15 in

— CLI machine-ID token
• — full authorization pipeline