Staff sign in with a second factor, and every action is audited. Every action on these pages is executed by the API, which is the only enforcement point: the rights gate, the editor-role gate, the separation of audit from editorial authority and, when the dormant critical-alert control is switched on, its two-distinct-editor rule are all applied server-side. Nothing here can bypass them, and a refusal is shown with the server's own reason.
Intake reference data was refused by the server (HTTP 401)
Authentication required.
Sign in with a staff account to use this page.
Evidence waiting for a post
Readers cannot see these until a post that reveals them is released (release clock, Task 013).