diff --git a/REQUESTS.md b/REQUESTS.md
index 3f94537..1c73afe 100644
--- a/REQUESTS.md
+++ b/REQUESTS.md
@@ -81,8 +81,10 @@ Dan for this item. Two things are worth recording:
   further DNS is needed for the demo. `cube.yokogawa.tech` is for engineers on the public
   side only; `ai-api` reaches Cube container-to-container and never by hostname.
 - **The names resolving is not the same as the services answering.** The Caddyfile blocks
-  and the Authelia rules for `ai`, `api` and `cube` still have to be applied on the host —
-  see the deployment note. Until they are, all three names return nothing.
+  and the Authelia rules for `ai`, `api` and `cube` were applied on the host the same day;
+  all four AI hostnames now return 302 to the auth portal. What is still unproven is the
+  part no check here can reach: an operator on `cicore1`, signed in with Duo, getting an
+  answer end to end.
 
 The original request follows, unchanged.
 
diff --git a/authelia/access-rules.md b/authelia/access-rules.md
index 1a64a50..973dd9d 100644
--- a/authelia/access-rules.md
+++ b/authelia/access-rules.md
@@ -43,6 +43,14 @@ Add each hostname at the phase that needs it. Every domain added here must also
 have a Caddyfile block with `import authelia` (`caddy/ai-routes.caddy`), and
 every Caddyfile block must have a rule here. One without the other is a hole.
 
+**Applied on lin001:** `lf` on 2026-08-20; `cube`, `api` and `ai` on
+2026-08-27, in one Authelia restart. Backup
+`~/authelia/configuration.yml.bak-ai-20260827`. All four now return 302 to the
+auth portal. Between the Caddy blocks going in and this rule landing, the three
+new hostnames returned **403** — Caddy serving a hostname Authelia has no rule
+for means `default_policy: deny`, which is the safe direction but is not
+obvious from the status code alone. `verify.sh` names that case explicitly.
+
 ## Phase 9: the document publisher rule
 
 Operator document upload splits the API in two. Anyone in `HTTPS_UserAccess`