25 lines
894 B
Markdown
25 lines
894 B
Markdown
# Security Checklist (Stage 4)
|
|
|
|
## Scope
|
|
- MVP on-prem deployment baseline
|
|
- API gateway + service-level RBAC
|
|
- Data persistence and backup handling
|
|
|
|
## Checklist
|
|
- [x] RBAC enforced on privileged endpoints (`auth/users`, `routing/queues`, `knowledge/categories`)
|
|
- [x] Role-denied requests return `403` without side effects
|
|
- [x] Request payload validation enabled via Pydantic models
|
|
- [x] SQL access uses parameterized ORM operations (SQLAlchemy)
|
|
- [x] Health and registry endpoints do not expose secrets
|
|
- [x] Backup archives created and restored via controlled scripts
|
|
- [x] Security smoke checks automated in `scripts/gate4_check.py`
|
|
|
|
## Verification Commands
|
|
- `python scripts/gate4_check.py`
|
|
- Optional artifact retention: `python scripts/gate4_check.py --keep-artifacts`
|
|
|
|
## Out of Scope for MVP
|
|
- LDAP/SSO integration
|
|
- External secrets manager integration
|
|
- WAF and SIEM integration
|