Authenticated request

Step	Skip condition
JwtAccessGuard	@PublicRoute, or path /metrics / /v1/metrics
RolesGuard	No @Roles metadata
WarehouseGuard	No authenticated user
PermissionsGuard	No @RequirePermissions metadata
TenantScopeGuard	Decorator absent. Platform admin exemption is in the guard comment

RequestLoggerMiddleware runs on *. The audit interceptor emits audit.log when @AuditLog is present. AuditLogListener writes AuditLog in-process. That write is not an outbox row. If the process dies after the response and before the listener finishes, the audit row can be missing. That timing was not measured.

Unknown JSON properties never reach the controller (forbidNonWhitelisted).