10-missing-jwt
Anonymous AI usage blocked
Missing Authorization header
Request sent with no Authorization header at all. The gateway's credential check rejects before policy evaluation.
jwtdenymissing
FIXTURE
No JWT — request sent without Authorization header.
EXPECTED OUTCOME
HTTP STATUS401
POLICY ENGINE NOT CONSULTEDREJECTED AT THE GATEWAY BEFORE POLICY EVALUATION
What this demonstrates
A request with no identity at all. Every AI action must be attributable to a known identity — anonymous usage means an audit trail with holes.
Accountability / attributionEU AI Act Art. 12
RUNNER
Execute scenario
Mints a JWT, sends the request through the live gateway, and compares the response against the expected outcome.
Requires the PolicyGate stack reachable on host ports 10000 / 8181.
WHY THIS MATTERS
Proves the JWT is mandatory — anonymous requests are blocked at the edge.