backend/src/main/java/com/hiveops/guide/config/SecurityConfig.java

@@ -37,7 +37,7 @@ public class SecurityConfig {
                         .requestMatchers("/actuator/health", "/error").permitAll()
                         // Read-only guide API: any authenticated user (audience gating done in the controller)
                         .requestMatchers(HttpMethod.GET, "/api/v1/guide/**")
-                            .hasAnyRole("USER", "CUSTOMER", "ADMIN", "MSP_ADMIN", "QDS_ADMIN", "BCOS_ADMIN")
+                            .hasAnyRole("USER", "CUSTOMER", "ADMIN", "MSP_ADMIN", "BCOS_ADMIN")
                         .anyRequest().authenticated()
                 )
                 .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);