Rhythm 2.0 Specifications

Appearance

WF-PFM-SEC-009Authorize a request at the gateway

Markdown

WF-PFM-SEC-009

Authorize a request at the gateway

Markdown
  • DocumentDraft
  • ImplementationObserved

Planning

Implements
CAP-PFM-SEC-015, CAP-PFM-SEC-007, CAP-PFM-SEC-002

KindWorkflowProduct areaPlatformModuleSecurity, Customers and WorkspacesRevision1ExaminercodexExamined on2026-10-23

Read atservices-platform ad3f6a65

Authorize a request at the gateway ​

What It Does ​

The gateway and receiving service share responsibility: the gateway verifies identity and builds the bounded grant context, while the service evaluates its declared operation, ownership and availability.

The Flow ​

The diagram separates the relevant success, alternative and failure paths. The numbered hop rows retain the detailed authority checks, delegated work and retry limits.

When Something Fails ​

The workflow applies to protected human routes. Machine and public routes have separate access contracts. No authorization step creates a missing membership, and a cached decision does not prove that the current database would still allow the request.

Fresh authorization does not create membership or identity records. Gateway cache keys include token, method and route template. One decision log is emitted per authorizer invocation, so cached gateway requests do not necessarily invoke or log fresh evaluation.

Fresh decisions use current database reads alongside per-process pool/manifest caches: sixty seconds fresh, with a last-known-good value for up to fifteen minutes during source failure. Missing usable metadata fails closed.

Open Design Questions ​

The recorded findings retain any stronger planning expectation, missing writer or unproved recovery path. Observed behavior does not approve those outstanding product choices.

License enforcement depends on the deployed mode. Unconfigured authorization defaults to licensing off; the design does not infer enforcement from the presence of a license record alone.

Controls

54 controls apply, from the corpus control catalogue.

TC-AVL-001 TC-AVL-004 TC-AVL-005 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-005 TC-AZ-006 TC-CHG-001 TC-CHG-002 TC-CHG-003 TC-CHG-004 TC-CHG-005 TC-CHG-006 TC-CRY-001 TC-CRY-002 TC-CRY-003 TC-CRY-004 TC-DAT-001 TC-DAT-002 TC-DAT-003 TC-DAT-004 TC-IAM-001 TC-IAM-002 TC-IAM-003 TC-IAM-004 TC-IAM-005 TC-IAM-006 TC-LOG-001 TC-LOG-004 TC-LOG-005 TC-MON-001 TC-MON-002 TC-MON-003 TC-PI-001 TC-PI-002 TC-PI-003 TC-PI-004 TC-PI-005 TC-PRV-001 TC-PRV-002 TC-PRV-004 TC-SEC-001 TC-SEC-002 TC-SEC-003 TC-SEC-004 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-TEN-004 TC-VEN-001 TC-VEN-002 TC-VEN-003

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.

Rhythm Software