diff --git a/lib/restbase.js b/lib/restbase.js
index <HASH>..<HASH> 100644
--- a/lib/restbase.js
+++ b/lib/restbase.js
@@ -50,6 +50,21 @@ RESTBase.prototype._makeChild = function(req) {
 
 
 RESTBase.prototype.request = function (req) {
+    // Protect the sys api from direct access
+    // Could consider opening this up with a specific permission later.
+    if (this._recursionDepth === 0 &&
+            (req.uri.params.api
+             // TODO: Remove once params.api is reliable
+             || req.uri.segments[1]) === 'sys') {
+        return Promise.reject(new rbUtil.HTTPError({
+            status: 403,
+            body: {
+                type: 'access_denied',
+                title: 'Access denied'
+            }
+        }));
+    }
+
     if (req.method) {
         req.method = req.method.toLowerCase();
     }
Disallow direct requests to the /{domain}/sys api

This is where our internal modules live, so unconditionally disallow direct
access from the outside. Additional unconditional ACL checks happen at the
path level (ex: per domain), as well as in each sys module. The main
contribution of this block is that it disallows direct access to some
resources where the user has *indirect* access to some resource when accessed
as part of another request.