BOT_REQUIRE_GROUP / LIVE_REQUIRE_GROUP in .env drive a header_regexp matcher after forward_auth (403 before the app). authentik/discord-roles-to-groups.py syncs Discord roles into groups at every login so access follows Discord roles without manual edits. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>