{"module":"CONNECTION-CHASSIS","mode":"attribute","modes":{"off":"no checks","attribute":"resolve caller, never block (default)","warn":"log violations, allow (dark-launch)","enforce":"403 on missing/invalid identity or insufficient scope"},"recentDenials":[],"note":"Flip at runtime (admin): POST /api/connect/enforcement { mode }. Or set CONNECT_ENFORCE_MODE env at boot."}