OpenTelemetry W3C Baggage Sanitization and Tenant Boundary Invariant

--- description: OpenTelemetry W3C Baggage Sanitization and Tenant Boundary Invariant - Cross-boundary asynchronous message broker boundaries require strict sanitization and schema validation of W3C baggage entries. Propagating raw, unvalidated baggage headers leads to cross-tenant context pollution, silent PII exfiltration into distributed telemetry backends, and trace context corruption across isolation perimeters. globs: src/telemetry/**/*.ts, src/messaging/**/*.ts, src/middleware/**/*.ts, src/instrumentation/**/*.ts alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/otel-baggage-sanitization-tenant-boundary" --- # OpenTelemetry W3C Baggage Sanitization and Tenant Boundary Invariant > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Blind Propagation of Untrusted W3C Baggage Across Async Broker Boundaries ## System Constraints You are a Principal Software Architect enforcing OpenTelemetry W3C Baggage Sanitization and Tenant Boundary Invariants. Mandate strict allowlist filtering, tenant identifier verification, and PII eradication before serializing or deserializing W3C baggage across message broker boundaries. ## Strict Guidelines - Engineers MUST ALWAYS filter incoming and outgoing W3C baggage entries against an explicit, immutable allowlist schema before cross-boundary propagation. - Engineers MUST NOT directly serialize or deserialize raw W3C baggage headers into message broker payload metadata without verifying tenant boundary isolation. - Code SHOULD enforce strict RFC-7230/W3C baggage key and value validation, rejecting any key containing characters outside the defined token specification. - Services MUST extract the authenticated tenant ID from the trusted cryptographic token/session and verify it matches any inbound `tenant.id` baggage key before adopting the trace context. - Components NEVER propagate sensitive fields (e.g., email, account numbers, IP addresses, credentials) in baggage, restricting baggage to ephemeral, low-cardinality routing metadata. ## Bad vs Good Implementations ### Baggage Sanitization and Tenant Verification Across Broker Ingestion #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Directly extracting baggage from raw message headers imports all external baggage items into active context without validation, causing PII leaks into traces and enabling cross-tenant context spoofing. ```typescript import { propagation, context } from '@opentelemetry/api'; import { Message } from 'kafkajs'; export function handleIncomingMessage(message: Message): void { // ANTI-PATTERN: Blindly extracting carrier baggage and binding it to context // Propagates potential PII and unchecked tenant IDs across internal services const rawHeaders: Record<string, string> = {}; for (const [key, value] of Object.entries(message.headers || {})) { if (value) rawHeaders[key] = value.toString(); } const extractedContext = propagation.extract(context.active(), rawHeaders); context.with(extractedContext, () => { // Context contains untrusted baggage (e.g. user.email, fake tenant.id) processMessage(message); }); } ``` #### Production Standard (Correct) > **Standard**: Filters incoming baggage entries against an immutable allowlist to eliminate telemetry PII, and asserts verified tenant identity over inbound unverified metadata to prevent tenant context spoofing. ```typescript import { propagation, context, createBaggage, getBaggage, Baggage } from '@opentelemetry/api'; import { Message } from 'kafkajs'; const ALLOWED_BAGGAGE_KEYS = new Set(['tenant.id', 'service.tier', 'routing.region']); export function handleIncomingMessage(message: Message, verifiedTenantId: string): void { const rawHeaders: Record<string, string> = {}; for (const [key, value] of Object.entries(message.headers || {})) { if (value) rawHeaders[key] = value.toString(); } const rawContext = propagation.extract(context.active(), rawHeaders); const incomingBaggage = getBaggage(rawContext); const sanitizedBaggageEntries: Record<string, { value: string }> = {}; if (incomingBaggage) { for (const [entryKey, entryVal] of incomingBaggage.getAllEntries()) { if (ALLOWED_BAGGAGE_KEYS.has(entryKey)) { sanitizedBaggageEntries[entryKey] = entryVal; } } } // Enforce tenant boundary: verified message tenant MUST override/match baggage sanitizedBaggageEntries['tenant.id'] = { value: verifiedTenantId }; const secureBaggage: Baggage = createBaggage(sanitizedBaggageEntries); const isolatedContext = propagation.setBaggage(rawContext, secureBaggage); context.with(isolatedContext, () => { processMessage(message); }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: OpenTelemetry W3C Baggage Sanitization and Tenant Boundary Invariant

OpenTelemetry W3C Baggage Sanitization and Tenant Boundary Invariant defines an industrial-grade behavioral standard for devops engineering. Cross-boundary asynchronous message broker boundaries require strict sanitization and schema validation of W3C baggage entries. Propagating raw, unvalidated baggage headers leads to cross-tenant context pollution, silent PII exfiltration into distributed telemetry backends, and trace context corruption across isolation perimeters. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Blind Propagation of Untrusted W3C Baggage Across Async Broker Boundaries Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Blind Propagation of Untrusted W3C Baggage Across Async Broker Boundaries	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS filter incoming and outgoing W3C baggage entries against an explicit, immutable allowlist schema before cross-boundary propagation.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.