Privileged workspace
Staff
Production staff access requires SSO, MFA, least privilege and audit. This fixture uses a local test identity only. Every action on these pages is executed by the API, which is the only enforcement point: the rights gate, the editor-role gate, the separation of audit from editorial authority and, when the dormant critical-alert control is switched on, its two-distinct-editor rule are all applied server-side. Nothing here can bypass them, and a refusal is shown with the server's own reason.
Review queue
The review queue was refused by the server (HTTP 403)
Fixture identity headers are not accepted in production mode. Use a Cognito or staff SSO bearer token.
This is the server enforcing authorization, not a display problem. The acting identity does not hold the role this endpoint requires. Nothing on this page can grant it.
Service-level position
The SLA ageing summary was refused by the server (HTTP 403)
Fixture identity headers are not accepted in production mode. Use a Cognito or staff SSO bearer token.
This is the server enforcing authorization, not a display problem. The acting identity does not hold the role this endpoint requires. Nothing on this page can grant it.
Critical alert rule
A non-official critical alert cannot be sent until two distinct authorized editors approve. No founder bypass exists. The rule is enforced by the API, not by this screen: a single editor attempting to approve twice, or to send with one approval, is refused and the refusal is shown.