Per-user/domain access rules for the forward-auth proxy with deny-overrides evaluation. Default-deny when rules exist, backward-compatible open access when no rules are configured. Admin dashboard with cookie-based auth for managing origins, access rules, sessions, and dry-run access checks. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>