---
title: "Axum Gateway Auth Boundaries Without Secrets"
description: "Where identity stops and routing begins in a Rust control-plane edge."
author: "Mohammad-Pouya Ghourchiani"
canonical: "https://ghourchiani.ir/blog/axum-gateway-auth-boundaries"
date: "2026-09-15"
lang: "en"
---
# Axum Gateway Auth Boundaries Without Secrets

## Direct answer

Put authentication at the gateway edge, keep handlers ignorant of credential storage, and never put secrets in repos or docs.

## Boundaries

- Edge: verify token/session, attach principal
- Core: authorize by role/capability only
- Ops UI: talk to public contracts, not raw DB

## Links

- Project: [/projects/nebulagrid](/projects/nebulagrid)
- Writing: [/blog/nebulagrid-control-plane](/blog/nebulagrid-control-plane)
- Expertise: [/expertise/rust](/expertise/rust)