AuthZEN PEP-to-PDP Signed Dynamic Context Envelope Propagation

Q: How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Propagating Mutable, Unsigned Raw JSON Authorization Context Across Distributed PEP-PDP Boundaries) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q: Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q: Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

AuthZEN PEP-to-PDP Signed Dynamic Context Envelope Propagation

--- description: AuthZEN PEP-to-PDP Signed Dynamic Context Envelope Propagation - Mandates that all dynamic contextual authorization payloads transmitted between Policy Enforcement Points (PEPs) and Policy Decision Points (PDPs) across microservice boundaries are encapsulated within cryptographically signed, immutable envelopes. Prevents PDP cache poisoning, context tampering, and Time-of-Check to Time-of-Use (TOCTOU) authorization drift by enforcing asymmetric JWS/PASETO validation and deterministic context-hash cache derivation. globs: src/auth/**/*.{ts,tsx}, src/security/**/*.{ts,tsx}, src/middleware/**/*.{ts,tsx}, src/services/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/authzen-pep-pdp-signed-context-envelope-guardrail" --- # AuthZEN PEP-to-PDP Signed Dynamic Context Envelope Propagation > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Propagating Mutable, Unsigned Raw JSON Authorization Context Across Distributed PEP-PDP Boundaries ## System Constraints You are a Principal Security Architect enforcing the OpenID Foundation AuthZEN PEP-to-PDP Dynamic Context Propagation Protocol Standard. You must mandate that authorization context passed between microservices, PEPs, and PDPs is strictly immutable, cryptographically signed, canonicalized, and bound to nonces and strict TTLs. Never permit raw, unsigned mutable JSON context dictionaries across network boundaries or inside PDP decision caching layers. ## Strict Guidelines - Engineers MUST ALWAYS encapsulate dynamic authorization context inside a cryptographically signed envelope (JWS or PASETO) before transmission across service boundaries or PEP-to-PDP interfaces. - Engineers MUST NOT evaluate or cache authorization decisions derived from unsigned, caller-supplied context dictionaries. - Code SHOULD enforce RFC 8785 JSON Canonicalization Scheme (JCS) before generating context signature digests to prevent deterministic hash mismatch. - Services MUST validate the envelope's cryptographic signature, issuer (`iss`), audience (`aud`), expiration time (`exp` <= 30 seconds), and replay nonce (`jti`) prior to parsing claims. - Components NEVER use partial or mutable payload elements as cache keys in PDP evaluation caches; cache keys MUST incorporate the cryptographic envelope digest. - PEPs MUST fail closed (deny-by-default) if dynamic context verification fails or if the signed context envelope cannot be resolved against the PDP key registry. ## Bad vs Good Implementations ### Unsigned Context Propagation and Evaluation vs. Cryptographically Signed AuthZEN Context Envelope #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The PEP forwards an unsigned, mutable context payload received over the wire directly to the PDP. Attackers can inject arbitrary context attributes (such as tenant IDs, IP origin bypasses, or elevation flags). Furthermore, the PDP cannot verify context provenance, leading to cache divergence and cross-tenant privilege escalation. ```typescript import { Request, Response, NextFunction } from 'express'; interface AuthZENRequest { subject: { id: string; roles: string[] }; action: { name: string }; resource: { id: string; type: string }; context: Record<string, unknown>; // Vulnerable: Unsigned, mutable context } // Anti-pattern: Forwarding raw, unverified context to PDP export async function evaluateAccessWithUnsignedContext(req: Request, res: Response, next: NextFunction) { const authContext = req.body.context; const decisionPayload: AuthZENRequest = { subject: { id: req.body.userId, roles: req.body.roles }, action: { name: req.method }, resource: { id: req.params.id, type: 'document' }, context: authContext // Context can be tampered with in-transit or poisoned in PDP cache }; const pdpResponse = await fetch('http://pdp-service/authzen/v1/evaluation', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(decisionPayload) }); const decision = await pdpResponse.json(); if (!decision.decision) { return res.status(403).json({ error: 'Access Denied' }); } return next(); } ``` #### Production Standard (Correct) > **Standard**: Dynamic context is deterministically sorted, cryptographically hashed, and wrapped in a short-lived (30s) signed JWS envelope by the PEP. The PDP can independently verify cryptographic integrity, prevent attribute tampering, detect replay attacks via UUID nonces, and safely utilize the context envelope digest for cache key collation without cache divergence. ```typescript import { Request, Response, NextFunction } from 'express'; import { SignJWT, jwtVerify, importJWK, type JWTPayload } from 'jose'; import { createHash } from 'node:crypto'; interface SecureAuthZENContext extends JWTPayload { iss: string; aud: string; sub: string; jti: string; exp: number; iat: number; action: string; resourceId: string; resourceType: string; contextHash: string; contextAttributes: Record<string, unknown>; } export async function evaluateAccessWithSignedEnvelope( req: Request, res: Response, next: NextFunction, pepPrivateKeyJwk: JsonWebKey, pdpPublicKeyJwk: JsonWebKey ) { const dynamicContext = { tenantId: req.headers['x-tenant-id'] as string, ipAddress: req.ip, clientCertFingerprint: req.socket.authorized ? 'verified' : 'unverified' }; // 1. Canonicalize and hash dynamic context attributes to guarantee immutability const canonicalContextJson = JSON.stringify(dynamicContext, Object.keys(dynamicContext).sort()); const contextHash = createHash('sha256').update(canonicalContextJson).digest('hex'); // 2. Sign context envelope using PEP asymmetric private key with strict TTL and nonce const privateKey = await importJWK(pepPrivateKeyJwk, 'EdDSA'); const now = Math.floor(Date.now() / 1000); const signedContextEnvelope = await new SignJWT({ contextHash, action: req.method, resourceId: req.params.id, resourceType: 'document', contextAttributes: dynamicContext }) .setProtectedHeader({ alg: 'EdDSA', typ: 'authzen-context+jwt' }) .setIssuer('pep.gateway.internal') .setAudience('pdp.auth.internal') .setSubject(req.body.userId) .setJti(crypto.randomUUID()) .setIssuedAt(now) .setExpirationTime(now + 30) // Strict 30-second envelope lifetime .sign(privateKey); // 3. Dispatch AuthZEN evaluation request containing the immutable envelope const pdpResponse = await fetch('https://pdp.auth.internal/authzen/v1/evaluations', { method: 'POST', headers: { 'Content-Type': 'application/json', 'X-Authzen-Context-Envelope': signedContextEnvelope }, body: JSON.stringify({ subject: { id: req.body.userId }, action: { name: req.method }, resource: { id: req.params.id, type: 'document' }, context_envelope: signedContextEnvelope }) }); if (!pdpResponse.ok) { return res.status(403).json({ error: 'Authorization verification failed' }); } const decision = await pdpResponse.json(); if (!decision.decision) { return res.status(403).json({ error: 'Access Denied' }); } return next(); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: AuthZEN PEP-to-PDP Signed Dynamic Context Envelope Propagation

AuthZEN PEP-to-PDP Signed Dynamic Context Envelope Propagation defines an industrial-grade behavioral standard for security engineering. Mandates that all dynamic contextual authorization payloads transmitted between Policy Enforcement Points (PEPs) and Policy Decision Points (PDPs) across microservice boundaries are encapsulated within cryptographically signed, immutable envelopes. Prevents PDP cache poisoning, context tampering, and Time-of-Check to Time-of-Use (TOCTOU) authorization drift by enforcing asymmetric JWS/PASETO validation and deterministic context-hash cache derivation. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Propagating Mutable, Unsigned Raw JSON Authorization Context Across Distributed PEP-PDP Boundaries Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Propagating Mutable, Unsigned Raw JSON Authorization Context Across Distributed PEP-PDP Boundaries	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS encapsulate dynamic authorization context inside a cryptographically signed envelope (JWS or PASETO) before transmission across service boundaries or PEP-to-PDP interfaces.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.