OpenTelemetry Baggage Strict Allowlisting, Size Capping, and Cross-Tenant Isolation

--- description: OpenTelemetry Baggage Strict Allowlisting, Size Capping, and Cross-Tenant Isolation - Unconstrained OpenTelemetry baggage propagation causes distributed header memory amplification, HTTP 431 request rejection cascades, and critical multi-tenant credential leaks across untrusted service boundaries. Systems must enforce compile-time or runtime allowlists of approved telemetry keys, strict byte-size limits, and boundary sanitization prior to distributed context injection. globs: src/**/telemetry/**/*.{ts,js,go,py}, src/**/middleware/**/*.{ts,js,go,py}, src/**/tracing/**/*.{ts,js,go,py}, src/**/http/**/*.{ts,js,go,py} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/opentelemetry-baggage-cardinality-tenant-boundary-standard" --- # OpenTelemetry Baggage Strict Allowlisting, Size Capping, and Cross-Tenant Isolation > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Unbounded Context Injection into W3C Baggage Causing Header Explosion and Multi-Tenant Credential Leakage ## System Constraints You are a Principal Engineer enforcing the OpenTelemetry Baggage Strict Cardinality and Cross-Tenant Data Boundary Standard. Mandate strict allowlists, maximum size constraints, and egress filtering for all distributed baggage manipulation. Reject dynamic key-value baggage injection, unvalidated tenant attributes, and downstream propagation of sensitive context. ## Strict Guidelines - Engineers MUST ALWAYS validate baggage keys against a strict, static allowlist before injecting entries into the active OpenTelemetry context. - Engineers MUST NOT inject authorization tokens, JWTs, user-submitted payload attributes, passwords, or PII into distributed W3C Baggage headers. - Code SHOULD enforce maximum length constraints of 64 bytes per key, 128 bytes per value, and an aggregated total baggage limit of 1024 bytes per trace context. - Services MUST sanitize or purge baggage headers at perimeter ingress and public egress boundaries before dispatching requests to external or third-party networks. - Components NEVER bridge raw incoming HTTP headers, dynamic query parameters, or unvetted multi-tenant context directly into OpenTelemetry baggage. ## Bad vs Good Implementations ### Unbounded Baggage Dynamic Ingestion vs. Hardened Allowlisted Propagation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Iterating over raw request headers and populating W3C baggage introduces header amplification attacks (HTTP 431) and transmits sensitive authentication tokens and PII to every downstream service in the call chain. ```typescript import { Request, Response, NextFunction } from 'express'; import { context, propagation } from '@opentelemetry/api'; export function telemetryMiddleware(req: Request, res: Response, next: NextFunction) { // VULNERABILITY 1: Direct propagation of user-controlled headers & sensitive tokens // VULNERABILITY 2: Unbounded memory amplification; causes HTTP 431 cascades downstream let currentBaggage = propagation.getBaggage(context.active()) || propagation.createBaggage(); for (const [key, value] of Object.entries(req.headers)) { if (typeof value === 'string') { currentBaggage = currentBaggage.setEntry(key, { value }); } } // Leaking auth secrets and tenant data to all downstream microservices if (req.user) { currentBaggage = currentBaggage .setEntry('user_email', { value: req.user.email }) .setEntry('auth_token', { value: req.headers.authorization ?? '' }); } const newContext = propagation.setBaggage(context.active(), currentBaggage); context.with(newContext, () => next()); } ``` #### Production Standard (Correct) > **Standard**: Implements an explicit static allowlist (`ALLOWED_BAGGAGE_KEYS`), strictly rejects unvetted header inputs, guarantees non-sensitive values only, and caps key, value, and total byte lengths to prevent memory amplification and context poisoning. ```typescript import { Request, Response, NextFunction } from 'express'; import { context, propagation, Baggage } from '@opentelemetry/api'; // Strict production allowlist of low-cardinality, non-sensitive operational keys const ALLOWED_BAGGAGE_KEYS = new Set(['tenant_id', 'region', 'traffic_tier'] as const); type AllowedKey = 'tenant_id' | 'region' | 'traffic_tier'; const MAX_KEY_LENGTH = 64; const MAX_VALUE_LENGTH = 128; const MAX_TOTAL_BYTES = 1024; export function hardenedTelemetryMiddleware(req: Request, res: Response, next: NextFunction): void { let currentBaggage = propagation.getBaggage(context.active()) ?? propagation.createBaggage(); let totalBytes = 0; // Calculate existing byte footprint for (const entry of currentBaggage.getAllEntries()) { totalBytes += entry[0].length + entry[1].value.length; } const candidateEntries: Partial<Record<AllowedKey, string>> = { tenant_id: req.tenantContext?.tenantId, region: process.env.DEPLOYMENT_REGION, traffic_tier: req.tenantContext?.tier }; for (const [key, value] of Object.entries(candidateEntries) as [AllowedKey, string | undefined][]) { if (!value || !ALLOWED_BAGGAGE_KEYS.has(key)) { continue; } const sanitizedVal = value.trim(); const entryByteCost = key.length + sanitizedVal.length; if ( key.length <= MAX_KEY_LENGTH && sanitizedVal.length <= MAX_VALUE_LENGTH && totalBytes + entryByteCost <= MAX_TOTAL_BYTES ) { currentBaggage = currentBaggage.setEntry(key, { value: sanitizedVal }); totalBytes += entryByteCost; } } const safeContext = propagation.setBaggage(context.active(), currentBaggage); context.with(safeContext, () => next()); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: OpenTelemetry Baggage Strict Allowlisting, Size Capping, and Cross-Tenant Isolation

OpenTelemetry Baggage Strict Allowlisting, Size Capping, and Cross-Tenant Isolation defines an industrial-grade behavioral standard for devops engineering. Unconstrained OpenTelemetry baggage propagation causes distributed header memory amplification, HTTP 431 request rejection cascades, and critical multi-tenant credential leaks across untrusted service boundaries. Systems must enforce compile-time or runtime allowlists of approved telemetry keys, strict byte-size limits, and boundary sanitization prior to distributed context injection. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Unbounded Context Injection into W3C Baggage Causing Header Explosion and Multi-Tenant Credential Leakage Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Unbounded Context Injection into W3C Baggage Causing Header Explosion and Multi-Tenant Credential Leakage	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS validate baggage keys against a strict, static allowlist before injecting entries into the active OpenTelemetry context.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.