# T02 — The operator role boundary

**Threat model.** A signed-in member who does not hold `operator-member`
tries to reach operator functionality by requesting its URLs directly.

**Slice.** `internal/server/operator.go` (especially the gate around line 165),
`internal/server/operator_partials.go`, the partials router in
`internal/server/server.go` near line 706, and `server.go:723` / `:754`.
Then survey the `internal/server/operator_*.go` handlers to see which ones
sit behind the gate and which register their own routes.

**Questions.**
1. Every operator route: does the role check run before the handler body?
   Name any route or partial that reaches data or a mutation without one.
2. Are HTMX partial endpoints gated the same way as the pages that embed them,
   or does the gate live only on the page handler?
3. Is the check applied on the write path, or only on the read that renders
   the form?
4. `HasRole` reads roles from the session. Between a person losing the operator
   role in Keycloak and their session expiring, what can they still do?
5. Do any operator handlers registered by integrations bypass the core gate?

**Not in scope.** Cross-tenant member access (T05). Session mechanics (T01).