## The problem The bench chassis has no way to reject a request that didn't come through GATE. [GATE](https://gitlab.com/gitlab-org/architecture/auth-architecture/design-doc/-/blob/main/design.md) attaches a **User Request Token (URT)** at the data plane. A service behind it verifies that token and refuses anything without one — otherwise a caller that bypasses the data plane reaches the handler unchallenged, and the coarse-grained authorization GATE performed ([AUTH-009](https://gitlab.com/gitlab-org/architecture/auth-architecture/design-doc/-/blob/main/decisions/009-l1-coarse-grained-access-controls.md)) counts for nothing. Two candidates already record the hole: - **Artifact Registry** verifies an end-user JWT via token exchange against the issuer JWKS, plus an interim shared service secret for IAM data-access. The bench spec omits this: [examples/artifact-registry gap 2](https://gitlab.com/gitlab-org/lab-bench/bench/-/blob/main/examples/artifact-registry/README.md#L64). - **gate-iam** requires both an interim shared service secret and an end-user JWT on every non-`Health` RPC. The bench spec omits this: [examples/gate-iam gap 2](https://gitlab.com/gitlab-org/lab-bench/bench/-/blob/main/examples/gate-iam/README.md#L114). ## Prior decisions From the 2026-06-04 weekly: - A composed LabKit module verifies the URT. The chassis provides the composition point and the startup guard; it doesn't implement verification itself. - Every inbound request verifies the URT. No per-service or per-endpoint opt-out exists in the schema. - Fine-grained authorization ("Mode 3") is tracked separately in [bench#97](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/97). - Health probes run on a separate `PROBE_PORT` outside the data plane and need no exemption. - GATE mints anonymous-principal URTs for public endpoints ([confirmed by @skundapur](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/87#note_3999775544)), so a login-free service still carries a URT. Which layer declares an endpoint public is still open. ## Constraint: no LabKit URT module exists yet There is no URT module in LabKit v2. Full verification can't be built here; this issue delivers the chassis composition point and startup guards so adopting the module later is a wiring change rather than a redesign. The interim state (pre-STS) also affects the seam's API surface. Before [STS](https://gitlab.com/gitlab-org/architecture/auth-architecture/design-doc/-/blob/main/design.md#secure-token-service) ships, adopters like AR receive a Rails-issued JWT ([AUTH-021](https://gitlab.com/gitlab-org/architecture/auth-architecture/design-doc/-/blob/main/decisions/021-modular-service-token-payload-schema.md)) rather than a GATE-minted URT. That token identifies the principal but has a different claim shape and carries no permissions. The seam must accept both issuers. The AuthZ implications of the interim token belong on [bench#97](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/97). ## Acceptance criteria - [ ] The decision on mandatory URT verification with no opt-out is recorded in `docs/decisions/` - [ ] The chassis has a composition point the LabKit URT module drops into, in both Go and Rust - [ ] ~~On gRPC, verification runs when a stream opens; a test shows an unverified stream is rejected at open~~ Moved to [bench#102](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/102), since the chassis doesn't serve gRPC yet ([bench#65](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/65)) - [ ] The local-dev path is decided and documented; no adopter has to invent their own bypass, and it can't reach a production build - [ ] Until the LabKit module exists, an assembly on the interim path logs at startup that it verifies the Rails-issued JWT with a key set fixed for the life of the process; once the module exists, a production build without it fails - [ ] AR and gate-iam express their real inbound auth posture, and gap 2 is retired in both examples - [ ] Full verification is tracked as blocked on the LabKit URT module, with an upstream issue filed if one doesn't exist Out of scope: implementing token verification (owned by LabKit), [Mode 3 fine-grained authorization (bench#97)](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/97), and service-to-service transport identity, which is mTLS covered by [bench#68](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/68) inbound and [bench#71](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/71) outbound. Part of [DM-4: Phase 1 Inbound](https://gitlab.com/groups/gitlab-org/lab-bench/-/epics/4).