call-center/docs/security/checklist.md

Security Checklist (Stage 4)

Scope

• MVP on-prem deployment baseline
• API gateway + service-level RBAC
• Data persistence and backup handling

Checklist

• RBAC enforced on privileged endpoints (auth/users, routing/queues, knowledge/categories)
• Role-denied requests return 403 without side effects
• Request payload validation enabled via Pydantic models
• SQL access uses parameterized ORM operations (SQLAlchemy)
• Health and registry endpoints do not expose secrets
• Backup archives created and restored via controlled scripts
• Security smoke checks automated in scripts/gate4_check.py

Verification Commands

• python scripts/gate4_check.py
• Optional artifact retention: python scripts/gate4_check.py --keep-artifacts

Out of Scope for MVP

• LDAP/SSO integration
• External secrets manager integration
• WAF and SIEM integration