10-missing-jwt
Anonymous AI usage blocked
Missing Authorization header
Request sent with no Authorization header at all. Envoy's jwt_authn rejects before ext_authz.
jwtdenymissing
FIXTURE
No JWT — request sent without Authorization header.
EXPECTED OUTCOME
HTTP STATUS401
BYPASSES OPAREJECTED BEFORE EXT_AUTHZ — OPA NOT CONSULTED
What this demonstrates
A request with no identity at all. Every AI action must be attributable to a known identity — anonymous usage means an audit trail with holes.
Accountability / attributionEU AI Act Art. 12
RUNNER
Execute scenario
Mints a JWT, sends the request through the live Envoy, and compares the response against the expected outcome.
Requires the PolicyGate stack reachable on host ports 10000 / 8181.
WHY THIS MATTERS
Proves the JWT is mandatory — anonymous requests are blocked at the edge.