diff --git a/apps/api/src/public/read-content.controller.ts b/apps/api/src/public/read-content.controller.ts
index f827af6..902417d 100644
--- a/apps/api/src/public/read-content.controller.ts
+++ b/apps/api/src/public/read-content.controller.ts
@@ -1,6 +1,7 @@
 import { Controller, Get, Param, Req } from '@nestjs/common';
 
 import { AuthedRequest } from '../auth/auth.guard';
+import { AuthenticatedOnly } from '../permissions/permission.decorators';
 import { PublicPageContent, PublicService } from './public.service';
 
 /**
@@ -16,7 +17,10 @@ import { PublicPageContent, PublicService } from './public.service';
 export class ReadContentController {
   constructor(private readonly publicPages: PublicService) {}
 
+  // Session required (explicit access rule, issue #52); per-page read
+  // permission is enforced in the service (resolve → canAccessPage → 404).
   @Get(':pondSlug/:pageSlug')
+  @AuthenticatedOnly()
   async content(
     @Param('pondSlug') pondSlug: string,
     @Param('pageSlug') pageSlug: string,