subagentpermissions

Every POST/PATCH route on every D1-backed primitive in the subagent*.com family (identities, contracts, tasks, citations, rubrics, outcomes, evaluations, brands, code, prompts, skills, roles, memories, and more)

requireBearerAuth(request, env.<SITE>_WRITE_SECRET) in workers/_shared/kit/http.ts — returns 503 if no secret is configured, 401 if the bearer token doesn't match, null (proceed) otherwise

The direct functional analogue of restrict-access.md's Members setting: it doesn't control who can *read* a site (every GET route is open, matching claude-tag's "anyone in the channel" default) but it does control who can *act* — the same "who can invoke Claude at all" question, applied to "who can write to this primitive."

admins/restrict-access.md, "Control who can invoke Claude Tag" / "Members"