Let HTTP targets inherit service authentication, bypass it, or block access. Validate and persist the action, expose it through the API, and deliver it to the proxy. Private services reject bypass.
Validation: service/manager, store, and management-to-proxy integration race tests passed; scoped lint passed.
