---
id: "edge-auth-unset"
type: "rule"
severity: "info"
url: "https://localhost:3000/catalogue/rules/edge-auth-unset"
---

# Edge authentication not stated

The design requires every hop into data, secrets, queues and AI to say how it authenticates, and an edge into one of them has no auth.

| | |
|---|---|
| Severity | info |
| Selects | every edge |
| Components in scope | 2,366 |

## Why

How a caller proves who it is decides what a leak costs: a password or a key in configuration can be copied and used from anywhere, a managed identity or an IAM role cannot. With security.edgeAuthDeclared set, the design has promised to say which on every such hop. Set auth on this edge: managed-identity, iam-role, service-account, workload-identity, api-key, oauth, mtls, basic or none.

## What it checks

It looks at every edge, and fires when:

- all of these hold:
  - the design requirement `security.edgeAuthDeclared` is true
  - the edge's `auth` has no value
  - the edge's target node:
    - the node is a sql-database, nosql-database, cache, object-store, queue, stream, key-management, ai-service or search-index

Message template:

```
Edge '{{edge.from}}' -> '{{edge.to}}' reaches data, secrets or an AI service and does not say how it authenticates. Set auth on the edge.
```

## Applies to

This rule is about an edge, so it belongs to a pair of nodes rather than one component.

2,366 catalogue components fall under it.

## Tripped by

Reference designs whose broken twin names this rule in its header:

- [llm-gateway](https://localhost:3000/d/zeema/llm-gateway)

## Source (`rule` YAML, verbatim)

```yaml
# yaml-language-server: $schema=../schema/rule.schema.json
# The design promises that every hop into stored data, secrets, queues and AI vendors says how it
# authenticates, and this one does not. Whether the caller holds a password, a key in its
# environment, or a cloud identity is the difference between a leak that bills and one that cannot
# happen; the edge's `auth` is where the design says which.
# Opt-in through security.edgeAuthDeclared, so a design that never talks about authentication is
# not told about every hop it draws.
# Tripped by: designs/reference/llm-gateway/design.broken.yaml
schemaVersion: "1"
type: "rule"
id: "edge-auth-unset"
severity: "info"
select:
  edge: {}
when:
  all:
    - requirement: "security.edgeAuthDeclared"
      equals: true
    - field: "auth"
      exists: false
    - to:
        kind:
          - "sql-database"
          - "nosql-database"
          - "cache"
          - "object-store"
          - "queue"
          - "stream"
          - "key-management"
          - "ai-service"
          - "search-index"
message: "Edge '{{edge.from}}' -> '{{edge.to}}' reaches data, secrets or an AI service and does not say how it authenticates. Set auth on the edge."
```

Human page: https://localhost:3000/catalogue/rules/edge-auth-unset