@@ -44,7 +44,7 @@ export type ListControlsApiV1ControlsGetRequest = {
    */
   tag?: string | null | undefined;
   /**
-   * When true, include direct agent associations, policy associations, and target bindings for each listed control.
+   * When true, include direct agent associations, policy associations, and, when target filters are supplied, target bindings for each listed control.
    */
   includeAttachments?: boolean | undefined;
   /**
 
@@ -47,7 +47,6 @@
 from ..errors import (
     APIError,
     APIValidationError,
-    AuthenticationError,
     ConflictError,
     DatabaseError,
     ForbiddenError,
@@ -143,19 +142,18 @@ async def _clone_and_bind_context(request: Request) -> dict[str, Any]:
     }
 
 
-def _attachment_target_context(request: Request) -> dict[str, str]:
-    context: dict[str, str] = {}
+def _attachment_target_context(request: Request) -> dict[str, str] | None:
+    """Return target context only when both attachment identifiers are valid."""
     target_type = request.query_params.get("attachment_target_type")
     target_id = request.query_params.get("attachment_target_id")
-    if target_type is not None:
-        if not _is_target_context_value(target_type):
-            return {}
-        context["target_type"] = target_type
-    if target_id is not None:
-        if not _is_target_context_value(target_id):
-            return {}
-        context["target_id"] = target_id
-    return context
+    if (
+        target_type is None
+        or target_id is None
+        or not _is_target_context_value(target_type)
+        or not _is_target_context_value(target_id)
+    ):
+        return None
+    return {"target_type": target_type, "target_id": target_id}
 
 
 async def _optional_attachment_target_principal(request: Request) -> Principal | None:
@@ -165,20 +163,13 @@ async def _optional_attachment_target_principal(request: Request) -> Principal |
     if include_attachments.lower() not in _TRUE_QUERY_VALUES:
         return None
     target_context = _attachment_target_context(request)
-    try:
-        return await get_authorizer(Operation.CONTROL_BINDINGS_READ).authorize(
-            request,
-            Operation.CONTROL_BINDINGS_READ,
-            target_context,
-        )
-    except (AuthenticationError, ForbiddenError, NotFoundError):
-        if target_context:
-            raise
-        return None
-    except APIError:
-        if target_context:
-            raise
+    if target_context is None:
         return None
+    return await get_authorizer(Operation.CONTROL_BINDINGS_READ).authorize(
+        request,
+        Operation.CONTROL_BINDINGS_READ,
+        target_context,
+    )
 
 
 def _generated_clone_name(source_id: int, source_name: str) -> str:
@@ -235,6 +226,31 @@ def _validate_attachment_filters(
     attachment_target_id: str | None,
 ) -> None:
     if include_attachments:
+        if (attachment_target_type is None) != (attachment_target_id is None):
+            raise APIValidationError(
+                error_code=ErrorCode.VALIDATION_ERROR,
+                detail="Attachment target filters must be supplied together.",
+                resource="Control",
+                hint=(
+                    "Set both attachment_target_type and attachment_target_id, "
+                    "or remove both filters."
+                ),
+                errors=[
+                    ValidationErrorItem(
+                        resource="Control",
+                        field=(
+                            "attachment_target_type"
+                            if attachment_target_type is None
+                            else "attachment_target_id"
+                        ),
+                        code="missing_required_parameter",
+                        message=(
+                            "Set attachment_target_type and attachment_target_id "
+                            "together."
+                        ),
+                    )
+                ],
+            )
         return
     if attachment_target_type is None and attachment_target_id is None:
         return
@@ -1157,7 +1173,8 @@ async def list_controls(
         False,
         description=(
             "When true, include direct agent associations, policy associations, "
-            "and target bindings for each listed control."
+            "and, when target filters are supplied, target bindings for each "
+            "listed control."
         ),
     ),
     attachment_target_type: str | None = Query(
 
@@ -476,6 +476,7 @@ async def test_http_upstream_fails_closed_on_5xx():
 @pytest.mark.asyncio
 @pytest.mark.parametrize("status", [400, 422])
 async def test_http_upstream_unexpected_4xx_reports_upstream_rejection(status):
+    """Unexpected upstream 4xx responses retain the contract failure signal."""
     provider = _build_upstream(lambda req: httpx.Response(status, text="bad request"))
 
     with pytest.raises(APIError) as exc_info:
@@ -484,6 +485,7 @@ async def test_http_upstream_unexpected_4xx_reports_upstream_rejection(status):
     assert exc_info.value.status_code == 502
     assert exc_info.value.error_code == "AUTH_UPSTREAM_REJECTED"
     assert str(status) in exc_info.value.detail
+    assert "request shape" in exc_info.value.hint
 
 
 @pytest.mark.asyncio
 
@@ -11,11 +11,11 @@
 import pytest
 from agent_control_evaluators import RegexEvaluatorConfig
 from agent_control_models import ConditionNode
-from agent_control_models.errors import ErrorCode, ErrorReason
+from agent_control_models.errors import ErrorCode
 from agent_control_server.auth_framework import Operation, Principal, set_authorizer
 from agent_control_server.db import get_async_db
 from agent_control_server.endpoints import controls as controls_module
-from agent_control_server.errors import APIError, BadRequestError, ForbiddenError
+from agent_control_server.errors import BadRequestError, ForbiddenError
 from agent_control_server.main import app
 from agent_control_server.models import (
     DEFAULT_NAMESPACE_KEY,
@@ -1355,20 +1355,18 @@ def test_list_controls_expands_filtered_control_attachments(
     }
 
 
-def test_list_controls_caps_inline_target_attachments(
+def test_list_controls_omits_target_attachments_without_filter(
     client: TestClient,
 ) -> None:
     control_id, control_name = _create_control(client, name=f"Attachments-{uuid.uuid4()}")
     _set_control_data(client, control_id, deepcopy(VALID_CONTROL_PAYLOAD))
-    binding_ids = [
+    for index in range(25):
         _create_target_binding(
             client,
             control_id=control_id,
             target_type="log_stream",
             target_id=f"ls-{index}",
         )
-        for index in range(25)
-    ]
 
     resp = client.get(
         "/api/v1/controls",
@@ -1380,15 +1378,12 @@ def test_list_controls_caps_inline_target_attachments(
 
     assert resp.status_code == 200, resp.text
     attachments = resp.json()["controls"][0]["attachments"]
-    assert len(attachments["targets"]) == 20
-    assert attachments["targets_total"] == 25
-    assert attachments["targets_truncated"] is True
-    assert [target["binding_id"] for target in attachments["targets"]] == list(
-        reversed(binding_ids[-20:])
-    )
+    assert attachments["targets"] == []
+    assert attachments["targets_total"] == 0
+    assert attachments["targets_truncated"] is False
 
 
-def test_list_controls_omits_targets_without_binding_read_authorization(
+def test_list_controls_skips_target_authorization_without_filter(
     client: TestClient,
 ) -> None:
     control_id, control_name = _create_control(client, name=f"Attachments-{uuid.uuid4()}")
@@ -1435,59 +1430,84 @@ async def authorize(
         "targets_total": 0,
         "targets_truncated": False,
     }
-    assert (Operation.CONTROL_BINDINGS_READ, {}) in calls
+    assert not any(operation == Operation.CONTROL_BINDINGS_READ for operation, _ in calls)
 
 
-def test_list_controls_omits_targets_when_broad_binding_read_upstream_rejects(
+@pytest.mark.parametrize(
+    ("params", "expected_context"),
+    [
+        ({"include_attachments": "true"}, None),
+        (
+            {
+                "include_attachments": "true",
+                "attachment_target_type": "log_stream",
+                "attachment_target_id": "ls-prod",
+            },
+            {"target_type": "log_stream", "target_id": "ls-prod"},
+        ),
+    ],
+)
+def test_list_controls_builds_complete_attachment_auth_context(
     client: TestClient,
+    params: dict[str, str],
+    expected_context: dict[str, str] | None,
 ) -> None:
-    control_id, control_name = _create_control(client, name=f"Attachments-{uuid.uuid4()}")
-    _set_control_data(client, control_id, deepcopy(VALID_CONTROL_PAYLOAD))
-    _create_target_binding(
-        client,
-        control_id=control_id,
-        target_type="log_stream",
-        target_id="ls-prod",
-    )
     calls: list[tuple[Operation, dict[str, Any] | None]] = []
 
-    class BindingReadRejectAuthorizer:
+    class RecordingAuthorizer:
         async def authorize(
             self,
             request: Any,
             operation: Operation,
             context: dict[str, Any] | None = None,
         ) -> Principal:
             calls.append((operation, context))
-            if operation == Operation.CONTROL_BINDINGS_READ:
-                raise APIError(
-                    status_code=502,
-                    error_code=ErrorCode.AUTH_UPSTREAM_REJECTED,
-                    reason=ErrorReason.INTERNAL_ERROR,
-                    detail="Authorization service rejected the authorization check.",
-                )
             return Principal(namespace_key=DEFAULT_NAMESPACE_KEY, is_admin=True)
 
-    set_authorizer(BindingReadRejectAuthorizer())
+    set_authorizer(RecordingAuthorizer())
 
-    resp = client.get(
-        "/api/v1/controls",
-        params={
-            "name": control_name,
-            "include_attachments": "true",
-        },
-    )
+    resp = client.get("/api/v1/controls", params=params)
 
     assert resp.status_code == 200, resp.text
-    controls = resp.json()["controls"]
-    assert controls[0]["attachments"] == {
-        "agents": [],
-        "policies": [],
-        "targets": [],
-        "targets_total": 0,
-        "targets_truncated": False,
-    }
-    assert (Operation.CONTROL_BINDINGS_READ, {}) in calls
+    binding_contexts = [
+        context for operation, context in calls if operation == Operation.CONTROL_BINDINGS_READ
+    ]
+    if expected_context is None:
+        assert binding_contexts == []
+    else:
+        assert binding_contexts == [expected_context]
+
+
+@pytest.mark.parametrize(
+    "params",
+    [
+        {"include_attachments": "true", "attachment_target_type": "log_stream"},
+        {"include_attachments": "true", "attachment_target_id": "ls-prod"},
+    ],
+)
+def test_list_controls_rejects_incomplete_attachment_filters_without_auth_call(
+    client: TestClient,
+    params: dict[str, str],
+) -> None:
+    calls: list[tuple[Operation, dict[str, Any] | None]] = []
+
+    class RecordingAuthorizer:
+        async def authorize(
+            self,
+            request: Any,
+            operation: Operation,
+            context: dict[str, Any] | None = None,
+        ) -> Principal:
+            calls.append((operation, context))
+            return Principal(namespace_key=DEFAULT_NAMESPACE_KEY, is_admin=True)
+
+    set_authorizer(RecordingAuthorizer())
+
+    resp = client.get("/api/v1/controls", params=params)
+
+    assert resp.status_code == 422, resp.text
+    assert resp.json()["error_code"] == "VALIDATION_ERROR"
+    assert not any(operation == Operation.CONTROL_BINDINGS_READ for operation, _ in calls)
 
 
 def test_list_controls_rejects_target_filter_without_binding_read_authorization(
@@ -1538,19 +1558,22 @@ async def authorize(
     ) in calls
 
 
-def test_list_controls_rejects_attachment_namespace_mismatch(
+def test_list_controls_does_not_require_target_authorization_without_filter(
     client: TestClient,
 ) -> None:
     control_id, control_name = _create_control(client, name=f"Attachments-{uuid.uuid4()}")
     _set_control_data(client, control_id, deepcopy(VALID_CONTROL_PAYLOAD))
 
+    calls: list[Operation] = []
+
     class MismatchedBindingReadAuthorizer:
         async def authorize(
             self,
             request: Any,
             operation: Operation,
             context: dict[str, Any] | None = None,
         ) -> Principal:
+            calls.append(operation)
             namespace_key = (
                 "other-namespace"
                 if operation == Operation.CONTROL_BINDINGS_READ
@@ -1568,8 +1591,9 @@ async def authorize(
         },
     )
 
-    assert resp.status_code == 403
-    assert resp.json()["error_code"] == "AUTH_INSUFFICIENT_PRIVILEGES"
+    assert resp.status_code == 200, resp.text
+    assert resp.json()["controls"][0]["attachments"]["targets"] == []
+    assert Operation.CONTROL_BINDINGS_READ not in calls
 
 
 def test_list_controls_rejects_attachment_filters_without_expansion(