KArtSell.Aegis/docs/CURRENT/AEG-X-005_RECONCILIATION_AUTH_DECISION_REQUIRED.md

AEG-X-005 — Reconciliation authorization decision required

Source / Assumption / Unknown / Decision Required

• Source: src/KArtSell.Modules.ModelOperations/PortfolioReconciliation/Endpoints.cs, ReconciliationEngine.cs, ReconcileTradeHandler.cs, the existing endpoint authority hardening evidence, and v60 docs/authorization-sensitive-data-v15.md / permission manifest.
• Assumption: Reconciliation data and correction operations are not public; the endpoint declarations must become role/policy protected before production registration is treated as complete.
• Unknown: No approved role or policy identifier for Reconciliation is present in the current source, WBS contract, or module documentation. The v60 reference delegates role-to-permission mapping to deployment and therefore does not provide a safe concrete role to copy.
• Decision Required: Security/Operations/DBA owners must assign separate read and reconcile/correction authorities for the four routes below.

Affected routes

Route	Operation	Current state	Required decision
GET /reconciliation/holdings	read holdings	AllowAnonymous + [DontRegister]	read role/policy
GET /reconciliation/mismatches	read mismatch data	AllowAnonymous + [DontRegister]	read role/policy
POST /reconciliation/reconcile-trade	correction/reconcile command	AllowAnonymous + [DontRegister]	write/reconcile role, idempotency authority
GET /reconciliation/report/daily	read operational report	AllowAnonymous + [DontRegister]	read/report role

The code intentionally does not invent a role name or silently reuse an unrelated Risk/Portfolio role. The four endpoints are currently [DontRegister] so unresolved anonymous routes cannot be exposed in production. Once approved, this document is the input for a single endpoint-authority Slice with endpoint tests and negative authorization evidence.

Replay-safety finding

POST /reconciliation/reconcile-trade accepts a nullable IdempotencyKey, and ReconcileTradeHandler generates a new GUID when it is missing. That means the same logical request can produce different outbox idempotency keys. The next approved Reconciliation BE Slice must require and validate the key at the boundary, persist the request/result binding, and prove replay behavior before the endpoint is considered production-ready. No fallback key or mutation was introduced in this audit.

Verification

rg -n "AllowAnonymous\(\)" src/KArtSell.Modules.ModelOperations/PortfolioReconciliation
PASS: exactly four declarations, all marked `[DontRegister]` pending authority approval (2026-08-12)

This document is a decision record, not production authorization evidence.