## MODIFIED Requirements

### Requirement: Pluggable authentication hook with a safe default
The system SHALL evaluate every platform SDK route through a configurable
scope-aware `AuthProvider` hook. The deployable Cloud Control Plane SHALL
reject anonymous access outside an explicit insecure-development override, but
production startup SHALL not require configured static bearer credentials.

#### Scenario: Production starts without configured bearer credentials
- **WHEN** the Cloud Control Plane is configured as production with a usable
  database and no static bearer credential configuration
- **THEN** startup succeeds and protected platform routes reject unauthenticated
  requests

#### Scenario: Explicit local anonymous override
- **WHEN** a non-production operator explicitly enables the insecure
  anonymous-development override
- **THEN** platform routes may use an anonymous principal and the application
  records that insecure mode is active

#### Scenario: Custom AuthProvider is honored
- **WHEN** a caller configures a custom `AuthProvider` that rejects a request
  or omits its required scope
- **THEN** the platform SDK route returns an authentication or authorization
  error without executing its handler operation

## REMOVED Requirements

### Requirement: Python SDK supports authenticated requests
**Reason**: The deployment no longer provisions or accepts static bearer
credentials for public platform access; human operations use Cloud user
sessions.

**Migration**: Replace bearer-token SDK workflows with authenticated Console
user-session workflows. A non-human service credential model is outside this
change and must be designed separately before reintroducing SDK automation.