A route-scoped predicate evaluated before a WebSocket handshake is accepted.

Guards receive the complete upgrade context, including the principal when middleware authenticated it. A route evaluates its guards in declared order; the first refusal prevents the handshake.