diff --git a/services/nginx/app/traits/route_t.php b/services/nginx/app/traits/route_t.php
index 6dfba45d..1cde838c 100644
--- a/services/nginx/app/traits/route_t.php
+++ b/services/nginx/app/traits/route_t.php
@@ -375,6 +375,10 @@ trait route_t
                         return true;
                     }
                 }
+                // IMPORTANT: When a subuser is authenticated and a subusers node key is defined
+                // the permission must ONLY pass if the explicit subuser node is granted.
+                // Do NOT fall back to classic user permissions in this branch.
+                return false;
             }
             $user = $auth->get_user();
             if (!$user) {