---
id: w1/m9/t004
title: Enable BEX_OPENFGA_URL in the prod api Deployment + cross-tenant 403 acceptance
worker: worker1
status: done
estimate: 25m
depends_on: [w1/m9/t003]
---

## Objective

Flip prod from allow-all to enforced authz: uncomment `BEX_OPENFGA_URL` in the prod api Deployment and prove cross-tenant isolation end-to-end (tenant A's key gets 403 on tenant B's service).

## Context

- `lego/operator/config/api/deployment.yaml` — `BEX_OPENFGA_URL` is deliberately commented out ("until tenant onboarding exists", per docs/ADR012-auth.md and the 2026-07-08 audit).
- docs/ADR006-bex-api.md's Authorization paragraph documents "Unset (the current prod default until tenant onboarding exists)" — update it once flipped.

## Steps

1. Uncomment the env var; `kustomize build lego/operator/config/default` sanity check.
2. On the mock cluster with FGA + store on: mint two tenants + one key each, one App each; script the cross-checks (A→A 200, A→B 403, unauthenticated 401).
3. Update docs/ADR006-bex-api.md + docs/ADR012-auth.md prod-default sentences.

## Files

- `lego/operator/config/api/deployment.yaml`
- `docs/ADR006-bex-api.md`, `docs/ADR012-auth.md`
- `scripts/` (extend `auth-e2e.sh` or add the cross-tenant check to it)

## Acceptance criteria

- [ ] Scripted acceptance passes on the mock cluster: A→A allowed, A→B 403, no-auth 401.
- [ ] `kustomize build` output shows `BEX_OPENFGA_URL` set; docs updated.

## Out of scope

- OpenFGA HA/tuning; migrating pre-existing prod Apps into a tenant (follow-up note if needed).
