Axum Gateway Auth Boundaries Without Secrets
Direct answer
Put authentication at the gateway edge, keep handlers ignorant of credential storage, and never put secrets in repos or docs.
Boundaries
- Edge: verify token/session, attach principal
- Core: authorize by role/capability only
- Ops UI: talk to public contracts, not raw DB
Links
- Project: /projects/nebulagrid
- Writing: /blog/nebulagrid-control-plane
- Expertise: /expertise/rust