An API gateway can protect north–south traffic while leaving internal east–west calls exposed to overreach. Mutual TLS (mTLS) closes part of that gap by requiring both endpoints to authenticate with certificates, not merely encrypting the connection. section 11.1.2 section 12.5.2
In an internal service architecture, mTLS supports authorization as follows:
- A service-mesh sidecar establishes mTLS with the peer sidecar and verifies the calling workload’s identity. section 11.1.2 section 12.5.2
- The proxy extracts that identity and adds it to a normalized PARC request sent to the policy decision point. section 11.1.2 section 12.5.2
- The policy engine still decides whether the action is permitted; mTLS supplies trustworthy evidence about which workload made the request. section 12.5.2
- This pattern fits controlled internal calls, but is less practical for browser clients, SaaS integrations, and bearer-token APIs. section 12.5.2
Docs to Search
When Docs sends a document to Search, the Docs sidecar authenticates the workload with mTLS and consults Cedar before forwarding the request. A policy can allow indexing generally while denying documents classified as Legal. section 11.1.2
Figure 11.2 Service mesh enforcement with sidecars. Cedar evaluates each document sent from Docs to Search. Documents tagged "Legal" are denied; others are allowed.
Trace the internal request from the Docs workload through sidecar authentication and Cedar evaluation to the Search service. section 11.1.2
