Traffic security

Wizard type: Auth (kind=traffic-security).

Steps

1. Create rule → Auth.
2. Fill and save:
   1. Basics: kebab-case name, enable, priority, labels, description
   2. Service: callee namespace/service (identity comes from auth mode, not spoofable headers)
   3. Auth mode: Pole managed identity (recommended) / custom Header (compat)
   4. Sub-rules: blacklist / whitelist / service-level; allow or deny
3. Publish after the rule exists.

Constraints

• ≥1 sub-rule
• At most one service-level rule, without API scope
• API-level needs ≥1 protected API
• Console no longer creates shared rule-level CUSTOM_HEADER credentials

Related

• Authorization (management principals/policies; different from traffic security)
• Governance overview