A2A and AGUI routes now enforce authorization alongside authentication, with scope mappings merged per interface at the mount prefix. Requests over these interfaces are checked against the scopes they actually need rather than being waved through once authenticated, closing a gap in multi-interface deployments.