ai-customer-service/docs/SECURITY_BOUNDARY.md

Security Boundary

Trust Model

RequireRoles RBAC Middleware

Location: internal/http/middleware/authz.go:RequireRoles

• What it does: Enforces role-based access control (RBAC) by checking the X-CS-Actor-ID and X-CS-Actor-Role headers against an allow-list of permitted roles.
• What it does NOT do: It does not verify the authenticity, integrity, or origin of these headers. A malicious client can forge both headers.
• Trust boundary: This middleware assumes that an upstream component (API Gateway, reverse proxy, or JWT validation layer) has already performed real authentication and has stripped or validated any forged headers before they reach this service.

Production Deployment Requirements

• An API Gateway or ingress controller must authenticate requests using JWT, mTLS, or an equivalent mechanism before forwarding them to ai-customer-service.
• The gateway must sanitize or reject unauthorized X-CS-Actor-* headers.
• Direct exposure of the service to the public internet without an authenticating gateway is not supported.