diff --git a/packages/api/src/__tests__/assistant-tools-auth-guard.test.ts b/packages/api/src/__tests__/assistant-tools-auth-guard.test.ts
new file mode 100644
index 0000000..5e3790c
--- /dev/null
+++ b/packages/api/src/__tests__/assistant-tools-auth-guard.test.ts
@@ -0,0 +1,31 @@
+import { describe, expect, it, vi } from "vitest";
+import { SystemRole } from "@capakraken/shared";
+
+vi.mock("@capakraken/application", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("@capakraken/application")>();
+  return {
+    ...actual,
+    getDashboardBudgetForecast: vi.fn().mockResolvedValue([]),
+    getDashboardPeakTimes: vi.fn().mockResolvedValue([]),
+    listAssignmentBookings: vi.fn().mockResolvedValue([]),
+  };
+});
+
+import { executeTool, type ToolContext } from "../router/assistant-tools.js";
+import { createToolContext } from "./assistant-tools-notification-test-helpers.js";
+
+describe("assistant tool auth guard", () => {
+  it("returns a stable assistant error when authenticated assistant context is missing", async () => {
+    const ctx = {
+      ...createToolContext({}, SystemRole.ADMIN),
+      session: null,
+      dbUser: null,
+    } as unknown as ToolContext;
+
+    const result = await executeTool("list_users", "{}", ctx);
+
+    expect(JSON.parse(result.content)).toEqual({
+      error: "Authenticated assistant context is required for this tool.",
+    });
+  });
+});