A locked door, not a broken page

The one idea

Where the gate lives

Every matter work-surface (Brief, Record, Hearings, Filings…) is a thin page under one fat layout, matters/[matterId]/layout.tsx. That layout performs the single entry read via getMatterCached. It is therefore the one place the whole detail subtree enters through — so it is the one place the gate belongs. Block it here and no child page renders.

Before & after

What the register still shows

The block is on open, nothing else. The register keeps listing every matter and each row stays clickable; the settings audit is untouched. This Story adds no hiding anywhere — it only changes what happens the moment an ungranted open is refused.

What shipped

Naming whom to ask (Story-3011)

A blocked editor should not have to hunt for who can let them in. Once #3011 shipped the access-contacts read — a deliberately minimal, firm-isolation-only payload of the lead counsel + firm admins (name / email / userId, no matter content) — the modal names them:

The fallback is not an afterthought — it is the same generic body the base modal shipped, so a slow or failed contacts read degrades to a still-useful sentence, never a broken or empty modal. A contact with no display name falls back to its email, so the sentence is never blank.

The brain must not think you’re reading the file (Codex P1)

SurfacePublisher derives the active surface from the URL. But the URL still says /matters/42/brief while the layout is showing the block — so, uncorrected, it would advertise the matter.brief surface and Atlas would reason as if counsel were reading the brief. The fix models the block as a first-class overlay: the modal publishes a kind: "modal" matter.notAuthorized surface (agent null), and the publisher yields to any active overlay rather than clobbering it. When counsel clicks “Back to matters”, the overlay unmounts and the pathname change re-runs the publisher, which resumes normally.

Why a modal, and why no dismiss

An AlertDialog — not a plain dialog — is the right primitive: it is a decision the user must acknowledge, not a panel they can idly close to reveal content behind it. There is nothing behind it. The matter shell never rendered, because the layout returned the modal in its place. The single forward action is the honest one: go back to where every matter you can open is listed.

Verification

Codegen sync — committed separately as chore(api): sync generated client: openapi/app-api.json + permission-map.json vendored from pramaan-functions main (Story-3011, #835) and the kubb client regenerated pinned to the mirror (LI-6). The generated useAppGetMatterAccessContacts hook is what the modal consumes — no hand-rolled client.

Observability — the one new backend hop, the access-contacts BFF proxy, is auto-instrumented at the shared gateway seam (pramaan-docs ADR-065/104); no new manual span is warranted (pramaan-docs ADR-124). The entry read and its 403 already exist and are logged there.