An access proxy protects the user API and one service path still bypasses...

The path exists, but normalization changes which route wins and the broader machine policy applies first.