OpenTelemetry W3C Baggage Cross-Tenant Isolation & Propagation Guardrail

--- description: OpenTelemetry W3C Baggage Cross-Tenant Isolation & Propagation Guardrail - Enforces strict schema allowlists and byte-length boundaries on OpenTelemetry W3C Baggage headers across distributed boundaries. Prevents multi-tenant PII/secret data leakage and downstream APM high-cardinality index degradation by stripping untrusted distributed context keys at ingress and egress gateways. globs: src/telemetry/**/*.{ts,js,py,go}, src/middleware/**/*.{ts,js,py,go}, src/tracing/**/*.{ts,js,py,go} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/otel-w3c-baggage-cross-tenant-isolation-production-standard" --- # OpenTelemetry W3C Baggage Cross-Tenant Isolation & Propagation Guardrail > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Unrestricted W3C Baggage Passthrough Causing Cross-Tenant Data Leakage and Cardinality Explosion ## System Constraints You are a Principal Engineer enforcing OpenTelemetry W3C Baggage Cross-Tenant Isolation Guardrail. Mandate invariants that restrict distributed baggage propagation to deterministic, explicitly allowlisted keys with bounded lengths across VPC boundaries. Reject implicit Baggage forwarding, unbounded dynamic keys, and sensitive multi-tenant identifier leaking. ## Strict Guidelines - Engineers MUST ALWAYS wrap the standard W3C Baggage propagator with an AllowlistFilteringPropagator at ingress and egress service boundaries. - Engineers MUST NOT serialize PII, authorization tokens, session IDs, request payloads, or raw tenant secrets into W3C Baggage entries. - Services MUST clamp baggage key names to a strict regex (^[a-z0-9_.-]{1,32}$) and baggage values to a maximum length of 64 bytes. - Code SHOULD isolate tenant execution context using verified authentication claims rather than trusting incoming unauthenticated distributed baggage. - Components NEVER bridge inbound unverified baggage headers directly into outbound downstream HTTP/gRPC/Kafka remote procedure calls without schema sanitation. ## Bad vs Good Implementations ### Ingress/Egress W3C Baggage Propagation Filtering #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Directly extracting and propagating untrusted W3C Baggage headers leads to cross-VPC data leakage (e.g., tokens or internal topology details leaking downstream) and cardinality explosion in trace indexes when dynamic keys or high-cardinality IDs are stored. ```typescript import { propagation, defaultTextMapGetter, Context } from '@opentelemetry/api'; import { Request, Response, NextFunction } from 'express'; // ANTI-PATTERN: Blindly extracts and forwards arbitrary baggage across VPC and tenant boundaries export function telemetryMiddleware(req: Request, res: Response, next: NextFunction): void { // Extracts unauthenticated baggage containing potentially unbounded keys, PII, or raw tenant tokens const extractedContext: Context = propagation.extract(req.headers, defaultTextMapGetter); // Outgoing calls will forward all untrusted keys (e.g. 'auth-token', 'user-email', 'internal-secret') propagation.bind(extractedContext, () => { next(); }); } ``` #### Production Standard (Correct) > **Standard**: Implements strict allowlist filtering against incoming Baggage context. Only explicitly designated keys (`tenant_id`, `environment`, `routing_tier`) pass downstream with truncated byte limits, preserving multi-tenant isolation and APM stability. ```typescript import { propagation, defaultTextMapGetter, Baggage, createBaggage, baggageEntryMetadataSymbol, Context } from '@opentelemetry/api'; import { Request, Response, NextFunction } from 'express'; // INVARIANT: Explicit immutable allowlist with rigid size constraints const ALLOWED_BAGGAGE_KEYS = new Set(['tenant_id', 'environment', 'routing_tier'] as const); const MAX_BAGGAGE_VALUE_BYTES = 64; function sanitizeBaggage(incoming: Baggage | undefined): Baggage { const entries: Record<string, { value: string }> = {}; if (!incoming) return createBaggage({}); for (const [key, entry] of incoming.getAllEntries()) { if (ALLOWED_BAGGAGE_KEYS.has(key as any)) { // Sanitize against injection and length limits const sanitizedValue = entry.value.trim().slice(0, MAX_BAGGAGE_VALUE_BYTES); entries[key] = { value: sanitizedValue }; } } return createBaggage(entries); } export function isolatedTelemetryMiddleware(req: Request, res: Response, next: NextFunction): void { const extractedContext: Context = propagation.extract(req.headers, defaultTextMapGetter); const incomingBaggage = propagation.getBaggage(extractedContext); // Scrub untrusted context before propagating to internal downstream services const safeBaggage = sanitizeBaggage(incomingBaggage); const sanitizedContext = propagation.setBaggage(extractedContext, safeBaggage); propagation.bind(sanitizedContext, () => { next(); }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: OpenTelemetry W3C Baggage Cross-Tenant Isolation & Propagation Guardrail

OpenTelemetry W3C Baggage Cross-Tenant Isolation & Propagation Guardrail defines an industrial-grade behavioral standard for devops engineering. Enforces strict schema allowlists and byte-length boundaries on OpenTelemetry W3C Baggage headers across distributed boundaries. Prevents multi-tenant PII/secret data leakage and downstream APM high-cardinality index degradation by stripping untrusted distributed context keys at ingress and egress gateways. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Unrestricted W3C Baggage Passthrough Causing Cross-Tenant Data Leakage and Cardinality Explosion Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Unrestricted W3C Baggage Passthrough Causing Cross-Tenant Data Leakage and Cardinality Explosion	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS wrap the standard W3C Baggage propagator with an AllowlistFilteringPropagator at ingress and egress service boundaries.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.