# Security Checklist (Stage 4)

## Scope
- MVP on-prem deployment baseline
- API gateway + service-level RBAC
- Data persistence and backup handling

## Checklist
- [x] RBAC enforced on privileged endpoints (`auth/users`, `routing/queues`, `knowledge/categories`)
- [x] Role-denied requests return `403` without side effects
- [x] Request payload validation enabled via Pydantic models
- [x] SQL access uses parameterized ORM operations (SQLAlchemy)
- [x] Health and registry endpoints do not expose secrets
- [x] Backup archives created and restored via controlled scripts
- [x] Security smoke checks automated in `scripts/gate4_check.py`

## Verification Commands
- `python scripts/gate4_check.py`
- Optional artifact retention: `python scripts/gate4_check.py --keep-artifacts`

## Out of Scope for MVP
- LDAP/SSO integration
- External secrets manager integration
- WAF and SIEM integration