Per-user/domain access rules for the forward-auth proxy with deny-overrides evaluation. Default-deny when rules exist, backward-compatible open access when no rules are configured. Admin dashboard with cookie-based auth for managing origins, access rules, sessions, and dry-run access checks.