Edge authentication not stated

infoedge-auth-unset

How a caller proves who it is decides what a leak costs: a password or a key in configuration can be copied and used from anywhere, a managed identity or an IAM role cannot. With security.edgeAuthDeclared set, the design has promised to say which on every such hop. Set auth on this edge: managed-identity, iam-role, service-account, workload-identity, api-key, oauth, mtls, basic or none.

Severity: info
Selects: every edge
Components in scope: 2,366

What it checks

It looks at every edge, and fires when:

— all of these hold:
— the design requirement `security.edgeAuthDeclared` is true
— the edge's `auth` has no value
— the edge's target node:
— the node is a sql-database, nosql-database, cache, object-store, queue, stream, key-management, ai-service or search-index

Message

Edge '{{edge.from}}' -> '{{edge.to}}' reaches data, secrets or an AI service and does not say how it authenticates. Set auth on the edge.

{{node.id}} style paths are filled in from the node, the edge or the design the finding is about.

Applies to · 2,366 components

This rule is about an edge, so it belongs to a pair of nodes rather than one component.

This rule names no kind: it reads the design as a whole.

Tripped by · 1

Reference designs whose broken twin names this rule in its header. The gate reads the same header, and fails when a rule no design trips.

llm-gatewayreference

Source

1# yaml-language-server: $schema=../schema/rule.schema.json
2# The design promises that every hop into stored data, secrets, queues and AI vendors says how it
3# authenticates, and this one does not. Whether the caller holds a password, a key in its
4# environment, or a cloud identity is the difference between a leak that bills and one that cannot
5# happen; the edge's `auth` is where the design says which.
6# Opt-in through security.edgeAuthDeclared, so a design that never talks about authentication is
7# not told about every hop it draws.
8# Tripped by: designs/reference/llm-gateway/design.broken.yaml
9schemaVersion: "1"
10type: "rule"
11id: "edge-auth-unset"
12severity: "info"
13select:
14  edge: {}
15when:
16  all:
17    - requirement: "security.edgeAuthDeclared"
18      equals: true
19    - field: "auth"
20      exists: false
21    - to:
22        kind:
23          - "sql-database"
24          - "nosql-database"
25          - "cache"
26          - "object-store"
27          - "queue"
28          - "stream"
29          - "key-management"
30          - "ai-service"
31          - "search-index"
32message: "Edge '{{edge.from}}' -> '{{edge.to}}' reaches data, secrets or an AI service and does not say how it authenticates. Set auth on the edge."

The same page as markdown, for an agent: /catalogue/rules/edge-auth-unset.md