From 62fb5c75f4d93f7addc53cd30f83809ae103fbf2 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 26 Apr 2026 16:39:18 +0000
Subject: [PATCH] docs: clarify why access_control rules are required per site

default_policy: deny means no rule = 403 even for logged-in users.
Step 4 now explains the two-sided requirement: Caddy controls what
traffic reaches Authelia; the rule controls what Authelia does with it.

https://claude.ai/code/session_012eTokAaGiZo7aGt1T2W9BC
---
 README.md | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 3eb71cb..511ef5e 100644
--- a/README.md
+++ b/README.md
@@ -304,9 +304,16 @@ chmod 600 authelia/secrets/*
 cp .env.example .env
 $EDITOR .env    # set DOMAIN, TZ; pin image versions if you want
 
-# 4) Uncomment access_control.rules in authelia/configuration.yml for the
-#    sites you want to gate. The domain is already templated -- just
-#    uncomment the right case block and choose one_factor or two_factor.
+# 4) For each site you added `import authelia` to in Caddy, uncomment the
+#    matching rule in authelia/configuration.yml under access_control.rules.
+#
+#    WHY: default_policy is 'deny'. If a domain reaches Authelia with no
+#    matching rule, Authelia returns 403 -- even to a logged-in user. The
+#    rule tells Authelia the domain is valid and what auth level to require.
+#
+#    Each rule is two lines -- just uncomment and pick one_factor or two_factor:
+#      - domain: 'cam.{{ env "DOMAIN" }}'
+#        policy: 'two_factor'
 $EDITOR authelia/configuration.yml
 
 # 5) Create your first user.