11-unknown-route
Unmapped endpoint refused
Unknown route
Valid JWT, but the request path is not in the gateway's RBAC allowlist. The gateway rejects with 403 before policy evaluation runs — the policy engine is never consulted.
gateway-rbacdenyroute
FIXTURE
tenant_id"acme-turkiye"
home_region"tst"
scopes
ai.chat.write
Defaults: iss = http://localhost/tst-issuer, aud = edge, exp = now+1h, kid = tester-rs256
EXPECTED OUTCOME
HTTP STATUS403
POLICY ENGINE NOT CONSULTEDREJECTED AT THE GATEWAY BEFORE POLICY EVALUATION
What this demonstrates
A request to an endpoint no policy covers. Deny-by-default means new paths can't silently bypass governance.
Governance baseline / deny-by-default
RUNNER
Execute scenario
Mints a JWT, sends the request through the live gateway, and compares the response against the expected outcome.
Requires the PolicyGate stack reachable on host ports 10000 / 8181.
WHY THIS MATTERS
Proves only registered routes are accepted — unknown endpoints can't bypass the policy layer.