# AEG-X-005 — Reconciliation authorization decision required

## Source / Assumption / Unknown / Decision Required

- **Source:** `src/KArtSell.Modules.ModelOperations/PortfolioReconciliation/Endpoints.cs`, `ReconciliationEngine.cs`, `ReconcileTradeHandler.cs`, the existing endpoint authority hardening evidence, and v60 `docs/authorization-sensitive-data-v15.md` / permission manifest.
- **Assumption:** Reconciliation data and correction operations are not public; the endpoint declarations must become role/policy protected before production registration is treated as complete.
- **Unknown:** No approved role or policy identifier for Reconciliation is present in the current source, WBS contract, or module documentation. The v60 reference delegates role-to-permission mapping to deployment and therefore does not provide a safe concrete role to copy.
- **Decision Required:** Security/Operations/DBA owners must assign separate read and reconcile/correction authorities for the four routes below.

## Affected routes

| Route | Operation | Current state | Required decision |
| --- | --- | --- | --- |
| `GET /reconciliation/holdings` | read holdings | `AllowAnonymous` + `[DontRegister]` | read role/policy |
| `GET /reconciliation/mismatches` | read mismatch data | `AllowAnonymous` + `[DontRegister]` | read role/policy |
| `POST /reconciliation/reconcile-trade` | correction/reconcile command | `AllowAnonymous` + `[DontRegister]` | write/reconcile role, idempotency authority |
| `GET /reconciliation/report/daily` | read operational report | `AllowAnonymous` + `[DontRegister]` | read/report role |

The code intentionally does not invent a role name or silently reuse an unrelated Risk/Portfolio role. The four endpoints are currently `[DontRegister]` so unresolved anonymous routes cannot be exposed in production. Once approved, this document is the input for a single endpoint-authority Slice with endpoint tests and negative authorization evidence.

## Replay-safety finding

`POST /reconciliation/reconcile-trade` accepts a nullable `IdempotencyKey`, and `ReconcileTradeHandler` generates a new GUID when it is missing. That means the same logical request can produce different outbox idempotency keys. The next approved Reconciliation BE Slice must require and validate the key at the boundary, persist the request/result binding, and prove replay behavior before the endpoint is considered production-ready. No fallback key or mutation was introduced in this audit.

## Verification

```text
rg -n "AllowAnonymous\(\)" src/KArtSell.Modules.ModelOperations/PortfolioReconciliation
PASS: exactly four declarations, all marked `[DontRegister]` pending authority approval (2026-08-12)
```

This document is a decision record, not production authorization evidence.
