Authentication Enforcement at the API Gateway

Security Requirement

AI model APIs MUST require that all principals (humans and applications) are identified, authenticated, and authorized before requests reach the models. The API gateway is the primary enforcement point for this control.

AI software MUST implement a robust standard authentication mechanism or require integration with an identity provider by default. Reducing this security posture should only be an option the user explicitly chooses, never the default.

What Is Not Acceptable as Default

• No authentication at all (even for internal-only APIs)
• A single shared API key for all users
• An empty API key
• API key-only authentication without IdP integration

These approaches may seem to "facilitate use" but are not acceptable for cloud services and should not be the default for products.

Required Controls