The Node.js Express service pages because viewers with a read-only token are trying to publish into a shared cursor channel. The on-call opens an event sample from the property-management editor and sees the authorization boundary failed before the fan-out layer had to defend itself.

TL;DR: In a Node.js Express service, issue a short-lived, signed capability token that binds one authenticated viewer to one document and the single action subscribe . Validate its signature, expiry, audience, document, and action during the connection handshake; enforce the capability again for every client-originated message. Treat cursor delivery as ephemeral, ordered state rather than a durable command stream. A viewer may receive cursor positions, but a viewer token must never authorize publishing, presence mutation, history access, or a wildcard document.

The least complex design is one token, one document, one direction.…