GET endpoints are open to authenticated users (the service layer enforces DRAFT visibility). POST/PATCH/DELETE require @RequirePermission(BLOG_WRITE). WebMvcTest slice covers 401/403/200/201/204 paths. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>