VendorFlow validates JWT bearer tokens from the OIDC authority configured by
Jwt:Authority; the expected resource is Jwt:Audience. Configure both using
user secrets or environment variables (Jwt__Authority, Jwt__Audience), not
source-controlled settings. Development can use a local Keycloak realm.
Roles: applicant may create and submit; reviewer may decide applications;
administrator may recover manual-remediation workflows. The API takes the
decision and recovery actor from the authenticated subject, never from request
body input.
| Asset / boundary | Threat | Mitigation |
|---|---|---|
| API to caller | Anonymous approval | JWT authentication and reviewer policy |
| Recovery endpoint | Privilege escalation | Administrator-only policy and audit event |
| JWT configuration | Credential disclosure | Authority/audience externalized; no secrets committed |
| External compliance call | Availability failure | Bounded retries, incidents, manual remediation |
| SQL business state | Duplicate side effects | Idempotency records, worker executions, outbox |