11-unknown-route

Unmapped endpoint refused

Unknown route

Valid JWT, but the request path is not in Envoy's RBAC allowlist. Envoy rejects with 403 before ext_authz runs — OPA is never consulted.

envoy-rbacdenyroute

FIXTURE

tenant_id"acme-turkiye"

home_region"tst"

scopes

ai.chat.write

Defaults: iss = http://localhost/tst-issuer, aud = edge, exp = now+1h, kid = tester-rs256

EXPECTED OUTCOME

HTTP STATUS403

BYPASSES OPAREJECTED BEFORE EXT_AUTHZ — OPA NOT CONSULTED

What this demonstrates

A request to an endpoint no policy covers. Deny-by-default means new paths can't silently bypass governance.

Governance baseline / deny-by-default

RUNNER

Mints a JWT, sends the request through the live Envoy, and compares the response against the expected outcome.

Requires the PolicyGate stack reachable on host ports 10000 / 8181.

WHY THIS MATTERS

Proves only registered routes are accepted — unknown endpoints can't bypass the policy layer.