diff --git a/internal/directory/directory.go b/internal/directory/directory.go
index 1c8b365..e4c1cb4 100644
--- a/internal/directory/directory.go
+++ b/internal/directory/directory.go
@@ -28,6 +28,20 @@ type app struct {
 	mapsKey string
 }
 
+func MemberGate(cache *Cache, next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/auth/login" || r.URL.Path == "/auth/logout" || strings.HasPrefix(r.URL.Path, "/static/") {
+			next.ServeHTTP(w, r)
+			return
+		}
+		if !cache.Model().Member(strings.ToLower(auth.Email(r))) {
+			http.Error(w, "account is not in the directory", http.StatusForbidden)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
 func Register(mux *http.ServeMux, cache *Cache, mapsKey string) {
 	a := app{cache: cache, mapsKey: mapsKey}
 	for _, section := range sections {
diff --git a/internal/directory/model.go b/internal/directory/model.go
index f0b4d6f..35bb1d7 100644
--- a/internal/directory/model.go
+++ b/internal/directory/model.go
@@ -58,6 +58,15 @@ type Grade struct {
 	NextBand string `json:"nextBand,omitempty"`
 }
 
+func (m *Model) Member(email string) bool {
+	for _, p := range m.People {
+		if p.Email == email {
+			return true
+		}
+	}
+	return false
+}
+
 func (m *Model) DisplayName(email string) string {
 	for _, p := range m.People {
 		if p.Email == email {
diff --git a/main.go b/main.go
index c102846..6cf7484 100644
--- a/main.go
+++ b/main.go
@@ -118,5 +118,5 @@ func main() {
 		port = "8080"
 	}
 	log.Printf("listening on http://localhost:%s", port)
-	log.Fatal(http.ListenAndServe(":"+port, noCache(authn.Wrap(mux))))
+	log.Fatal(http.ListenAndServe(":"+port, noCache(authn.Wrap(directory.MemberGate(cache, mux)))))
 }
diff --git a/tools/startserver/main.go b/tools/startserver/main.go
index bf781fa..f5bec7a 100644
--- a/tools/startserver/main.go
+++ b/tools/startserver/main.go
@@ -15,7 +15,7 @@ import (
 )
 
 func main() {
-	email := flag.String("email", "dev@heliosschool.org", "session email for the minted cookie")
+	email := flag.String("email", "ian.gulliver@heliosschool.org", "session email for the minted cookie")
 	flag.Parse()
 	key := os.Getenv("SESSION_KEY")
 	if key == "" {