# Important Notes

- **Do not enable `verify_access=True` globally** until you have verified that every upstream
  caller sends headers that satisfy `access_rules.yml`. The PP-1518 PR demonstrates that
  flipping this bit without caller analysis can block legitimate traffic.
- **PP checks are per-handler, not per-middleware.** Add PP checks inside each handler
  function; do not rely on `before_request` hooks for PP logic.
- **FastAPI: `assert_access` vs `assert_authorization`** — Many FastAPI services have both
  functions in the logic layer. `assert_access` is the legacy path (no PP check);
  `assert_authorization` is the migrated path (PP first, legacy fallback). The migration
  usually requires only a one-word handler change; no new `auth.py` module is needed.
- **FastAPI: "No resource-level auth" is not the same as Flask's "No auth"** — In FastAPI,
  JWT is always required (by middleware), so unauthenticated requests are already rejected.
  "No resource-level auth" means any authenticated user can access any resource owned by
  any tenant. This still needs PP enforcement, but the blast radius of a regression is lower.
- **Callers that are AWS Lambdas** need dedicated M2M JWTs. File a ticket for each one;
  they cannot be migrated with the grass fallback pattern.
- **Workstation / frontend app callers** depend on workstation roles being hydrated
  from KDH topics (PP-1411 / PP-1442). Confirm with the PP team before Phase 3 (enforce).
- **All OWS service callers** must appear in `jwt_enabled_services.tf` in `terraform-infra`
  before their PP checks can go live.
- **`MigrationAuthorizationBackend` always returns allow** and emits `pp_auth.rollout.would_deny`
  on a would-deny. The shadow phase adds it as a side-effect-only call and leaves the existing
  legacy auth (grass / access-rules) intact, so production behavior is unchanged until the
  follow-up enforce PR swaps in `PdpAuthorizationBackend`. Do **not** let the handler short-circuit
  on the always-allow result during shadow — that would bypass legacy enforcement.
- **`get_authorized_tenants` is not covered by the always-allow guarantee.** `MigrationAuthorizationBackend`
  delegates it to the inner backend unchanged, so it may still raise even in shadow mode.