edge-to-service-trust-boundarylisted

# Edge-to-Service Trust Boundary The signed contract for **forwarded identity** in a gateway + microservices topology. The edge authenticates the end user once and forwards identity/tenant context to internal services; this skill defines how services can *trust* those forwarded claims without re-authenticating — and how they fail when the trust is violated. > Companion skills: `auth-and-rbac` (how the gateway authenticates and the `x-user-data` forwarding > mechanic), `multi-tenancy-patterns` (tenant resolution order + RLS), `security-and-hardening` > (OWASP boundary system). This skill is the **crypto contract + fail-closed semantics** between them — > it does not re-explain how the gateway logs a user in. ## When to use - Building a backend service that sits **behind** an API gateway / ingress that forwards identity - Designing the **edge signing** step (which headers to sign, canonicalization, secret rotation) - Implementing **service-side verification** of forwarded identity/tenant headers - Hardening against **header spoofing** or a caller reaching a service **directly** (bypassing the edge) - Preventing **replay** of captured signed requests - Detecting **conflicts** when identity/tenant can be resolved from more than one source - Reviewing code for **naked-header trust**, `verify_signature=False`, or disabled/commented-out auth ## The trust model in one paragraph The edge is the **only** component that authenticates the end user (session, JWT, OAuth). It then for