authorization.md

Authorization (Fail-Closed)

Policy

Privileged paper commands: buy, sell, limit, cancel.

Non-privileged (read/help): help, markets, market, book, portfolio, orders, history.

Rules

1. If command is not privileged → allow (still PAPER/DEMO labeled).
2. If privileged and user_id is missing/empty → deny.
3. If privileged and user_id is malformed (whitespace inside, non-printable) → deny.
4. If privileged and user_id not in ALLOWED_DEMO_USER_IDS → deny.
5. Otherwise → allow; then engine validates business rules.

There is no code path that mutates paper state for privileged commands before AuthGate.require.

Tests required

• Authorized allowlisted user succeeds
• Unauthorized user rejected
• Missing user rejected
• Malformed user rejected
• No bypass before auth