{"module":"CONNECTION-CHASSIS","mode":"attribute","modes":{"off":"no checks","attribute":"resolve caller, never block (default)","warn":"log violations, allow (dark-launch)","enforce":"403 on missing/invalid identity or insufficient scope"},"recentDenials":[{"ts":"2026-09-17T11:26:42.240Z","path":"/api/observations/ingest","scope":"observations:ingest","reason":"no valid identity (register at POST /api/connect/register)","wouldBlock":false},{"ts":"2026-09-17T11:26:42.282Z","path":"/api/observations/ingest","scope":"observations:ingest","reason":"no valid identity (register at POST /api/connect/register)","wouldBlock":false},{"ts":"2026-09-17T11:26:42.324Z","path":"/api/observations/ingest","scope":"observations:ingest","reason":"no valid identity (register at POST /api/connect/register)","wouldBlock":false}],"note":"Flip at runtime (admin): POST /api/connect/enforcement { mode }. Or set CONNECT_ENFORCE_MODE env at boot."}