@@ -105,19 +105,37 @@ func dialGateway(ep Endpoint) (net.Conn, error) {
 	if ep.Bearer != "" {
 		hdr.Set("Authorization", "Bearer "+ep.Bearer)
 	}
+	opts := &websocket.DialOptions{HTTPHeader: hdr}
+
+	// A gateway on a unix socket is addressed "unix:/path/to.sock". There is
+	// no host to put in a URL, so we keep a placeholder authority (which the
+	// server ignores) and teach the HTTP client to dial the socket instead.
+	// This is the local shape: `figaro serve` binds a unix socket, and a
+	// reverse proxy -- or a test -- reaches it without a port existing.
+	addr := ep.Address
+	if sock, ok := strings.CutPrefix(addr, "unix:"); ok {
+		opts.HTTPClient = &http.Client{
+			Transport: &http.Transport{
+				DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {
+					var d net.Dialer
+					return d.DialContext(ctx, "unix", sock)
+				},
+			},
+		}
+		ws, addr = "ws", "figaro.local"
+	}
 
 	// The handshake gets a deadline; the resulting conn does not inherit it,
 	// which is why the context is detached below.
 	ctx, cancel := context.WithTimeout(context.Background(), gatewayHandshake)
 	defer cancel()
 
-	c, resp, err := websocket.Dial(ctx, ws+"://"+ep.Address+"/v1/socket",
-		&websocket.DialOptions{HTTPHeader: hdr})
+	c, resp, err := websocket.Dial(ctx, ws+"://"+addr+"/v1/socket", opts)
 	if err != nil {
 		if resp != nil {
 			switch resp.StatusCode {
 			case http.StatusUnauthorized, http.StatusForbidden:
-				return nil, fmt.Errorf("gateway %s refused this credential (%s): check `figaro origin`",
+				return nil, fmt.Errorf("gateway %s refused this credential (%s)",
 					ep.Address, resp.Status)
 			case http.StatusNotFound:
 				return nil, fmt.Errorf("gateway %s has no tunnel at /v1/socket (%s): is that a figaro gateway?",
 
@@ -144,17 +144,76 @@ func TestTurnActivePredicateHandlesUnknownAria(t *testing.T) {
 	}
 }
 
-// The policy name is data, not a bool: an unknown name must fall back to
-// allow-all rather than silently selecting rules nobody asked for.
-func TestUnknownPolicyNameFallsBackToAllowAll(t *testing.T) {
-	hs := authzHandlers(t, true, "no-such-policy", &liveForkFigaro{id: "aria0001", turnActive: true})
-	params, err := rpc.WithCaller(rpc.ForkRequest{FigaroID: "aria0001"}, "aria0001", nil)
-	if err != nil {
-		t.Fatalf("WithCaller: %v", err)
+// AN UNKNOWN POLICY NAME MUST NOT FALL BACK TO ALLOW-ALL.
+//
+// This test asserted the opposite until 2026-08-25, and the behaviour it
+// pinned was a critical fail-open: `policy = "rules"` -- a name nobody had
+// implemented -- selected allow-all, so a config that read as locked down
+// gated nothing. A typo, an older binary, or a policy renamed between
+// releases all produced a wide-open daemon that looked configured.
+//
+// The name is still data, not a bool. But unknown data is a startup error:
+// config.ValidateAuthz refuses it before the daemon runs, and the factory
+// panics if the two lists ever drift, because failing loudly beats failing
+// open.
+func TestUnknownPolicyNameIsRefused(t *testing.T) {
+	l := &config.Loaded{Config: config.Config{
+		Authz: config.AuthzConfig{Policy: "no-such-policy"},
+	}}
+	err := l.ValidateAuthz()
+	if err == nil {
+		t.Fatal("an unknown policy name was accepted: it must refuse to start")
 	}
-	_, ferr := hs.Map[rpc.MethodFork](context.Background(), params)
-	if ferr != nil && strings.Contains(ferr.Error(), "deadlock") {
-		t.Fatalf("unknown policy name gated a request: %v", ferr)
+	// The refusal has to name the alternatives, or the operator is left
+	// guessing at a closed vocabulary.
+	for _, want := range config.KnownAuthzPolicies {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("refusal does not mention the known policy %q: %v", want, err)
+		}
+	}
+}
+
+// Every name config accepts, the factory must construct. This is the pairing
+// that makes the panic in handlers.policy unreachable in a validated config;
+// if it ever fails, one of the two lists moved without the other.
+func TestEveryKnownPolicyNameConstructs(t *testing.T) {
+	for _, name := range config.KnownAuthzPolicies {
+		l := &config.Loaded{Config: config.Config{Authz: config.AuthzConfig{Policy: name}}}
+		if err := l.ValidateAuthz(); err != nil {
+			t.Fatalf("%s: config refuses a name it lists as known: %v", name, err)
+		}
+		h := &handlers{config: l}
+		func() {
+			defer func() {
+				if r := recover(); r != nil {
+					t.Fatalf("%s: config accepts it but the factory panics: %v", name, r)
+				}
+			}()
+			if p := h.policy(); p == nil {
+				t.Fatalf("%s: factory returned a nil policy", name)
+			}
+		}()
+	}
+}
+
+// The `grants` policy must arrive deny-by-default when its table is empty.
+// This is the config-level half of authz.TestZeroGrantsDeniesEverything: a
+// policy that denies in isolation is worth nothing if the wiring hands the
+// daemon an allow-all instead.
+func TestGrantsPolicyWithNoTableDenies(t *testing.T) {
+	l := &config.Loaded{Config: config.Config{
+		Authz: config.AuthzConfig{Policy: "grants"},
+	}}
+	if err := l.ValidateAuthz(); err != nil {
+		t.Fatalf("grants with an empty table should start (and refuse everything): %v", err)
+	}
+	h := &handlers{config: l}
+	d := h.policy().Check(authz.Request{
+		Method:   rpc.MethodQua,
+		Identity: authz.Identity{FigaroID: "aria0001", Authenticated: true, Groups: []string{"admin"}},
+	})
+	if d.Allow {
+		t.Fatal("an empty grant table allowed figaro.qua: the table must deny by default")
 	}
 }
 
 
@@ -52,6 +52,17 @@ type ariaHub struct {
 	ln    net.Listener
 	conns map[*jkrpc.Server]struct{}
 	agent figaro.AgentServer
+	// guard wraps the served handler map with authentication and policy. It
+	// is a field rather than a call in handlers() because the hub is built in
+	// internal/angelus and the policy is assembled beside the angelus map:
+	// one guard, both doors.
+	//
+	// A NIL GUARD SERVES UNGUARDED, and that is what this endpoint did for
+	// its whole life before 2026-08-25: figaro.qua, figaro.set, study/cast/
+	// drop, interrupt and the queue verbs were reachable on an aria socket
+	// with no policy consulted, while authz.Guard wrapped only the angelus.
+	// The guarded set must equal the served set, so hubs.go always sets this.
+	guard func(map[string]jkrpc.HandlerFunc) map[string]jkrpc.HandlerFunc
 	// Nothing is buffered on purpose: a frame produced while no client is
 	// attached is owed to nobody, and a client that attaches catches up with
 	// a read rather than a replay.
@@ -235,6 +246,9 @@ func (hb *ariaHub) handlers() map[string]jkrpc.HandlerFunc {
 			return hb.route(ctx, method, params)
 		}
 	}
+	if hb.guard != nil {
+		return hb.guard(out)
+	}
 	return out
 }
 
 
@@ -0,0 +1,117 @@
+package angelus
+
+// THE GUARDED SET MUST EQUAL THE SERVED SET.
+//
+// Before 2026-08-25 it did not. authz.Guard wrapped the angelus map, and the
+// per-aria hub socket beside it served figaro.qua, figaro.set, figaro.study,
+// figaro.cast, figaro.drop, figaro.interrupt and the queue verbs with NO
+// policy consulted at all -- the entire agency surface, ungated, on a door a
+// gateway was about to expose.
+//
+// These tests fail if that regresses, and they fail by ENUMERATION rather
+// than by naming the methods they know about, so a method added later cannot
+// slip through by being absent from a list somebody forgot to update.
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"github.com/jack-work/figaro/api/rpc"
+	"github.com/jack-work/figaro/internal/authz"
+	"github.com/jack-work/figaro/internal/figaro"
+	"github.com/jack-work/jkrpc"
+)
+
+// TestHubHandlersAreGuarded walks every method the aria endpoint serves and
+// asserts the policy saw it. Enumerated from figaro.AgentMethods(), so a new
+// agent method is covered the moment it exists.
+func TestHubHandlersAreGuarded(t *testing.T) {
+	var seen []string
+	hb := newAriaHub("test", "")
+	hb.guard = func(m map[string]jkrpc.HandlerFunc) map[string]jkrpc.HandlerFunc {
+		return authz.Guard(m, authz.AriaHeader{Enabled: false},
+			authz.PolicyFunc(func(r authz.Request) authz.Decision {
+				seen = append(seen, r.Method)
+				return authz.Deny("policy consulted")
+			}))
+	}
+
+	served := hb.handlers()
+	methods := figaro.AgentMethods()
+	if len(served) != len(methods) {
+		t.Fatalf("hub serves %d methods but AgentMethods lists %d", len(served), len(methods))
+	}
+
+	for _, m := range methods {
+		h, ok := served[m]
+		if !ok {
+			t.Fatalf("%s is in AgentMethods but the hub does not serve it", m)
+		}
+		// The handler must refuse WITHOUT reaching route(): a guard that ran
+		// after dispatch would have already done the thing it was meant to
+		// prevent. hb has no wake/read/write here, so a leaked call panics or
+		// errors differently than a policy denial.
+		_, err := h(context.Background(), json.RawMessage(`{}`))
+		if err == nil {
+			t.Fatalf("%s: denied policy still returned success", m)
+		}
+		var jerr *jkrpc.Error
+		if !errorsAs(err, &jerr) || jerr.Code != authz.ErrCode {
+			t.Fatalf("%s: want an authz refusal, got %v", m, err)
+		}
+	}
+
+	if len(seen) != len(methods) {
+		t.Fatalf("policy saw %d methods, hub serves %d: %v", len(seen), len(methods), seen)
+	}
+}
+
+// TestAgencyMethodsAreOnTheGuardedDoor is the regression this whole file
+// exists for. These are the methods that grant AGENCY -- they run turns,
+// write boards, and rewire what an aria observes -- and each must be served
+// by the hub, which is now guarded. A method that quietly moved to an
+// unguarded door would pass every other test in the tree.
+func TestAgencyMethodsAreOnTheGuardedDoor(t *testing.T) {
+	agency := []string{
+		rpc.MethodQua,
+		rpc.MethodSet,
+		rpc.MethodStudy,
+		rpc.MethodDrop,
+		rpc.MethodCast,
+		rpc.MethodInterrupt,
+		rpc.MethodQueueUpdate,
+		rpc.MethodQueueDelete,
+	}
+	served := map[string]bool{}
+	for _, m := range figaro.AgentMethods() {
+		served[m] = true
+	}
+	for _, m := range agency {
+		if !served[m] {
+			t.Errorf("%s grants agency but is not on the aria endpoint: "+
+				"if it moved, confirm its new door is guarded", m)
+		}
+	}
+}
+
+// A nil guard serves unguarded. That is the pre-fix behaviour, kept only so
+// the hub can be built in tests without a policy -- and pinned here so nobody
+// mistakes it for the production path. hubFor always sets a guard.
+func TestNilGuardServesUnguarded(t *testing.T) {
+	hb := newAriaHub("test", "")
+	if hb.guard != nil {
+		t.Fatal("a freshly built hub should carry no guard until hubFor sets one")
+	}
+	if len(hb.handlers()) != len(figaro.AgentMethods()) {
+		t.Fatal("an unguarded hub should still serve the full method set")
+	}
+}
+
+func errorsAs(err error, target **jkrpc.Error) bool {
+	e, ok := err.(*jkrpc.Error)
+	if ok {
+		*target = e
+	}
+	return ok
+}
@@ -72,6 +72,11 @@ func (h *handlers) hubFor(id string) (*ariaHub, error) {
 	hb.read = h.readFromStore
 	hb.write = h.writeForHub
 	hb.dress = h.dressParams
+	// The aria socket serves the AGENCY methods -- qua, set, study, cast,
+	// interrupt, the queue verbs -- and until this line existed it served
+	// them with no policy at all, while the angelus door beside it was
+	// guarded. One guard, both doors: the guarded set is now the served set.
+	hb.guard = h.guardHandlers
 	if h.angelus.Backend != nil {
 		if n, ok := h.angelus.Backend.Node(id); ok {
 			hb.kind = n.Kind
 
@@ -134,20 +134,54 @@ func (h *handlers) authenticator() authz.Authenticator {
 	return authz.AriaHeader{Enabled: h.config != nil && h.config.CallerIdentityEnabled()}
 }
 
+// guardHandlers wraps a handler map with THIS daemon's authn and policy. It is
+// handed to every aria hub so the agency methods are gated by the same seam
+// that gates the angelus door: see ariaHub.guard for what it was like before.
+func (h *handlers) guardHandlers(m map[string]jkrpc.HandlerFunc) map[string]jkrpc.HandlerFunc {
+	return authz.Guard(m, h.authenticator(), h.policy())
+}
+
 // policy builds the configured authorization policy. The turn-active predicate
 // is read off the live registry: a dormant or unknown aria has no turn in
 // flight, so it cannot be mid-turn, and a fork of it is free to proceed.
+//
+// AN UNKNOWN NAME IS FATAL, and that is the whole point of the panic below.
+// This switch used to end in `default: return AllowAll()`, so a config naming
+// a policy this binary did not know -- a typo, an old binary, a policy not yet
+// written -- silently opened the daemon completely. Configuration validation
+// rejects unknown names before we get here (config.AuthzPolicy), so reaching
+// this line means the two lists have drifted, and failing loudly beats failing
+// open.
 func (h *handlers) policy() authz.Policy {
 	name := "allow-all"
 	if h.config != nil {
 		name = h.config.AuthzPolicy()
 	}
 	switch name {
+	case "allow-all":
+		return authz.AllowAll()
 	case "default":
 		return authz.DefaultRules(h.turnActive)
+	case "grants":
+		return h.grantsPolicy()
 	default:
-		return authz.AllowAll()
+		panic(fmt.Sprintf("authz policy %q is not known to this binary: "+
+			"config validation should have refused it (internal/config.AuthzPolicy)", name))
+	}
+}
+
+// grantsPolicy is the deny-by-default table. Its ZERO VALUE DENIES: an empty
+// or unparsed grant list refuses everything rather than allowing everything,
+// which is the opposite of what authz.Rules does and the reason grants are a
+// separate policy type rather than more Rules.
+func (h *handlers) grantsPolicy() authz.Policy {
+	var grants []authz.Grant
+	if h.config != nil {
+		for _, g := range h.config.Config.Authz.Grants {
+			grants = append(grants, authz.Grant{Groups: g.Groups, Methods: g.Methods})
+		}
 	}
+	return authz.Grants{Table: grants, Extra: authz.DefaultRules(h.turnActive)}
 }
 
 func (h *handlers) turnActive(ariaID string) bool {
 
@@ -28,6 +28,12 @@ type Identity struct {
 	// Label is an ASSERTED caller name (rpc.CallerLabelKey / FIGARO_CALLER),
 	// carried for ATTRIBUTION ONLY.
 	Label string
+	// Groups the authenticator vouched for. Empty for every credential that
+	// carries no group claim, which is every one of them today except the
+	// gateway's upstream authenticator (Remote-Groups). A grant table keys on
+	// these, so an authenticator that cannot vouch for a group can never
+	// satisfy one -- which is the correct failure direction.
+	Groups []string
 }
 
 // Attribution renders who is speaking, for the model and for the UI.