The limiter is outside the prompt data path by construction. It receives token counts and signed scope claims; it has no code path that reads a message body and no schema field that could store one. A full compromise of the decision plane exposes no customer content.
Prompts exist only in transit through llm-gateway and are never written to disk, log or queue. The usage event that leaves the gateway contains counts, not content (NFR8).
Service-to-service authentication is SPIFFE-issued mTLS, so a stolen network position is not sufficient to call the decision API — an attacker also needs a workload identity.
Controls per crossing
Internet → Perimeter: TLS 1.3, WAF, OIDC bearer validated against cached JWKS at the edge.
Perimeter → Application: mTLS with SPIFFE SVIDs, 5 ms deadline, no other route into the zone.
Application → State: TLS with per-service Valkey ACLs and PostgreSQL row-level security by tenant.
Egress: FQDN allow-list, provider credentials leased from Vault with a 15-minute TTL and never held in application config.
Risks
llm-gateway does see prompt content in memory. It is the highest-value target in the system and is deployed with a restricted syscall profile, no shell, and no debug endpoints in production.
Administrators can read any tenant's usage metadata. Admin actions require step-up MFA and are written to an append-only audit log held for 7 years.
The self-hosted vLLM pool has no egress path at all, which is deliberate; it also means it cannot fetch model weights at runtime and must be provisioned through the delivery pipeline.
