read permissions on every GET

CHANGELOG.md

@@ -12,6 +12,31 @@ ADR-007 and ADR-002.
 
 ### Added
 
+- **Reading anything now needs a permission.** A sweep of the URL map found
+  **165 GET routes that answered anybody with no token at all**: the whole
+  asset inventory, every machine, PC, printer and network device, the USB
+  checkout history and who holds which drive, the staff directory, the core
+  reports. Guest access had been argued about one feature-flag at a time while
+  the front door stood open. Every one of them is now behind the read
+  permission it belongs to - `assets.view`, `machines.view`, `printers.view`
+  and so on - which also means the guest role can open exactly the ones a site
+  chooses and nothing else.
+
+  Thirty-three endpoints stay public, each named with its reason in
+  `tests/test_core/test_public_read_surface.py`: the app shell and its
+  bootstrap, the settings allowlist, images fetched by `<img src>` (which
+  carries no Authorization header), what a display kiosk renders before anybody
+  signs in, the parts and USB kiosks, the client scripts that run as SYSTEM
+  before a user session exists, and a secure-send link whose token is itself
+  the authorisation. That file is a standing gate: a new public read fails CI
+  until somebody adds it to the list, in front of a reviewer. Four more reads
+  need a login but no permission because the handler decides from who you are -
+  your own user record, your own API tokens, the role catalogue - and the same
+  test proves each still refuses an anonymous caller.
+
+  The employees plugin gained `employees.view`: the directory is names, SSOs,
+  photographs and reporting lines, and it had no permission at all.
+
 - **A guide's sections can be ticked off while you read it.** Only checklist
   items were tickable, which answered "what have I done" but not the question a
   long procedure actually raises - where was I. Somebody looks away to do the