Privileged workspace
Staff
Production staff access requires SSO, MFA, least privilege and audit. This fixture uses a local test identity only. Every action on these pages is executed by the API, which is the only enforcement point: the rights gate, the editor-role gate, the separation of audit from editorial authority and, when the dormant critical-alert control is switched on, its two-distinct-editor rule are all applied server-side. Nothing here can bypass them, and a refusal is shown with the server's own reason.
Reader invitations
Only these email addresses may sign in as readers during the pilot. The founder alone may change the list, and every change is audited. Staff accounts are set up separately and always need a second factor.
The invitation list was refused by the server (HTTP 403)
Fixture identity headers are not accepted in production mode. Use a Cognito or staff SSO bearer token.
This is the server enforcing authorization, not a display problem. The acting identity does not hold the role this endpoint requires. Nothing on this page can grant it.