> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Matcher authentication and actor-mapping contract

> Matcher accepts plugin-auth or disabled authentication, and actor-mapping permissions use hyphenated names.

<Badge stroke icon="calendar-days" iconType="regular">August 31, 2026</Badge> <Badge stroke icon="file-code" iconType="regular">Documentation correction</Badge> <Badge color="red" size="lg" stroke icon="triangle-exclamation" iconType="regular">Action required</Badge>

## Affects

Teams that configure Matcher authentication, multi-tenant deployments, or actor-mapping access.

## What changed

The documentation now correctly states that Matcher accepts `plugin-auth` or `disabled` for `AUTH_PROVIDER`. The former `workos` provider is retired and Matcher rejects it. `disabled` turns off authentication and authorization and can expose actor-mapping PII; use `plugin-auth` when you need those protections.

Actor-mapping permissions use hyphenated names such as `actor-mappings-read` and `actor-mappings-write`. The Console and API request up to 25 mappings per page.

This is a documentation correction of the current runtime behavior; it does not announce a runtime release.

## Impact

**Classification: Action required.**

## What you need to do

1. Replace `AUTH_PROVIDER=workos` if it appears in your Matcher deployment, and update actor-mapping role definitions to use the hyphenated permission names.
2. Review clients that assume 20-item pages before the next deployment.

### Deadline

Update affected configuration and access-control automation before the next Matcher deployment.