Function check_dispatch_admin 

pub async fn check_dispatch_admin(
    auth: &Option<Arc<AuthState>>,
    headers: &HeaderMap,
) -> Result<(), StatusCode>

16F: admin gate for the per-agent dispatch surface (/xagent/{name}).

The OUTER dispatch must be performed by a HUMAN ADMIN: agents may never dispatch agents, and service is read-only by design. The impersonated INNER request is separately authenticated and Cedar-gated AS THE AGENT (per-action matrix), so this gate answers exactly one question: “may this principal dispatch agent-users at all”.

Open mode (no auth configured) allows dispatch, consistent with the posture check_auth already applies. Dev-mode human tokens carry no role and are therefore rejected — dispatch testing requires a real admin JWT.