transcription/docs/ver1/ver1-step5-security-assumptions.md

Ver1 Step 5 Security Assumptions (Private-Network Baseline)

Operating Model

This system is operated as:

1. single operator
2. trusted private network
3. non-public deployment (no direct internet exposure for UI/API)

Out of scope for Step 5:

• enterprise IAM/SSO/RBAC
• internet-facing zero-trust edge controls
• multi-tenant user isolation

Step 5 Controls and Ownership

Control	Boundary Owner	Verification
Optional operator authentication for /ui* and /api* routes	src/transcription/security.py, src/transcription/app.py	tests/api/test_access_control.py
Unauthorized contract (401 + safe envelope + WWW-Authenticate)	src/transcription/api/errors.py	tests/api/test_access_control.py
Upload size guard (MAX_UPLOAD_BYTES)	src/transcription/services/upload.py, src/transcription/config.py	tests/services/test_upload.py
Fail-fast auth config when enabled	src/transcription/config.py	tests/test_config.py
Safe unexpected error messaging (reduced leak surface)	src/transcription/errors.py	tests/test_errors.py, worker/integration failure tests

Access-Control Policy (Step 5)

• Health endpoint (/healthz) remains unauthenticated for operability checks.
• When OPERATOR_ACCESS_ENABLED=true, protected paths require HTTP Basic auth:
  • /ui
  • /ui/...
  • /api/...
• Credentials are runtime-configured:
  • OPERATOR_USERNAME (default operator)
  • OPERATOR_PASSWORD (required when access is enabled)

Secrets Policy

• Secrets must be provided via runtime environment variables.
• Secrets must not be committed to source control.
• Secrets must not be logged.
• Example secret values in docs must always be placeholders.

Residual Risks (Accepted for Step 5)

1. HTTP Basic credentials are suitable only for trusted private-network deployment.
2. No per-user identity model (single shared operator credential).
3. No advanced brute-force/rate-limit controls in Step 5 scope.

These are carried forward for future hardening only if deployment posture changes.