[shrsv]

Adds a header-based admin override check for the upcoming ops dashboard.

Simulated for this demo: org auto-approve mode is always_approve (e.g. a low-traffic internal tool repo where the org has decided every PR auto-approves), and the simulated author is level 1 -- well under what eligibility would normally require.

[livereviewbot]

LiveReview automated review

Scanned 1 changed file (+5/-0).

🔴 Critical — Security: IsAdminRequest grants admin access based on a hardcoded bearer value compared directly against a request header. This is a real finding, flagged regardless of what the auto-approve policy ultimately decides.

[livereviewbot]

Auto-approve policy evaluation

Stage	Result
Mode override	always_approve -- short-circuits eligibility, LLM gate, and risk scoring entirely
Eligibility (author level 1, required 5)	skipped
Risk score (1 critical/security finding present)	skipped
Static ruleset gate	✅ pass -- no blocking rulesets configured on this repo

Verdict: AUTO-APPROVED, via mode override. This scenario exists to show the mode switch as what it is -- a deliberate, org-level escape hatch, not a bug. With always_approve set, only the static ruleset gate still runs; everything else (including the critical finding above) is bypassed by design. If this repo had a no-hardcoded-secrets-style ruleset configured, that would still catch it -- mode override skips the scored gates, not the static ones.

[livereviewbot]

Auto-approve policy verdict: APPROVED. always_approve mode override bypasses eligibility/LLM/risk scoring by design; only the static ruleset gate still ran, and none are configured here.