API Gateway Platform  ·  View 20 of 21  ·  Assurance

Security Trust Zones

Five zones by exposure, and the line where trust is established exactly once.

Editable source SVG draw.io All views
Internet — nothing here is trusted Any caller credential unverified Hostile traffic flood, stuffing Leaked credential valid until revoked Edge zone — absorbs, does not authenticate Global LB TLS ends here Cloud Armor WAF, rate, geo Connection limits before policy Policy zone — the trust boundary itself Authentication key / token / mTLS Denylist check 30 s SLO Scope authorisation per route Header strip + sign client identity discarded Service zone — trusts the signed context and nothing else Upstream services mTLS peer Sandbox estate separate project Management zone — no path from the internet Config API RBAC + approval Credential store verifiers only Audit ledger append-only TLS 1.2 / 1.3 absorbed unauthenticated denied mTLS + signed identity cache refill only allow and deny every change Security Trust Zones — Where Trust Is Established External / third party Risk / gap Interface / broker Security / platform Application we own Data store synchronous failure / alternate event / async Raw client credentials never cross into the service zone, and no arrow enters the management zone from the left. v 1.0 · owner Integration Platform Architecture · date 2026-09

Decisions

  • The policy zone is the trust boundary. Everything to its left is untrusted; everything to its right trusts the gateway's signed identity context and nothing else.
  • Client-supplied identity headers are stripped at admission and replaced. An upstream that reads a caller-controlled header is a privilege escalation waiting to be found.
  • Raw client credentials never cross into the service zone, so an upstream compromise does not yield callable credentials.

Assumptions

  • The management zone has no ingress path from the internet; operators reach it through the corporate identity provider under RBAC.
  • Credential-stuffing detection on authentication routes is independent of normal rate limits (assumption on thresholds).

Risks

  • A leaked credential is valid until revoked, and it is revoked on a 30 s propagation SLO rather than instantly. That window is the price of ADR-01 and is stated rather than hidden.
◀  The API Version Lifecycle All views Identity and Authorisation  ▶
Solution Architecture v1.0 · Google Cloud · Integration Platform Architecture · 2026-09 · 21 views · 18 architecture decision records20-security-trust-zones