# Ver1 Step 5 Security Assumptions (Private-Network Baseline)

## Operating Model

This system is operated as:

1. single operator
2. trusted private network
3. non-public deployment (no direct internet exposure for UI/API)

Out of scope for Step 5:

- enterprise IAM/SSO/RBAC
- internet-facing zero-trust edge controls
- multi-tenant user isolation

## Step 5 Controls and Ownership

| Control | Boundary Owner | Verification |
| --- | --- | --- |
| Optional operator authentication for `/ui*` and `/api*` routes | `src/transcription/security.py`, `src/transcription/app.py` | `tests/api/test_access_control.py` |
| Unauthorized contract (`401` + safe envelope + `WWW-Authenticate`) | `src/transcription/api/errors.py` | `tests/api/test_access_control.py` |
| Upload size guard (`MAX_UPLOAD_BYTES`) | `src/transcription/services/upload.py`, `src/transcription/config.py` | `tests/services/test_upload.py` |
| Fail-fast auth config when enabled | `src/transcription/config.py` | `tests/test_config.py` |
| Safe unexpected error messaging (reduced leak surface) | `src/transcription/errors.py` | `tests/test_errors.py`, worker/integration failure tests |

## Access-Control Policy (Step 5)

- Health endpoint (`/healthz`) remains unauthenticated for operability checks.
- When `OPERATOR_ACCESS_ENABLED=true`, protected paths require HTTP Basic auth:
  - `/ui`
  - `/ui/...`
  - `/api/...`
- Credentials are runtime-configured:
  - `OPERATOR_USERNAME` (default `operator`)
  - `OPERATOR_PASSWORD` (required when access is enabled)

## Secrets Policy

- Secrets must be provided via runtime environment variables.
- Secrets must not be committed to source control.
- Secrets must not be logged.
- Example secret values in docs must always be placeholders.

## Residual Risks (Accepted for Step 5)

1. HTTP Basic credentials are suitable only for trusted private-network deployment.
2. No per-user identity model (single shared operator credential).
3. No advanced brute-force/rate-limit controls in Step 5 scope.

These are carried forward for future hardening only if deployment posture changes.