Threat model
Threat model
| Threat | Control |
|---|---|
| Spoofed QoS/tenant headers | Entitlement resolution from authenticated mapping; untrusted requests become standard. |
| Tenant starvation | Weighted work accounting, max share/concurrency policy, aging, bounded admission. |
| Queue/memory exhaustion | Global depth/byte/body limits and early 413/429 backpressure. |
| Admin exposure | Separate loopback listener by default; internal ingress guidance. |
| SSRF | No per-request target; HTTPS except loopback; optional exact host allowlist. |
| Credential/log leakage | Environment/file/workload identity; auth headers stripped; no content logging. |
| Malicious provider response | Hop-by-hop and set-cookie response stripping; bounded channels. |
| Coordinator poisoning/replay | Namespace isolation, TLS/ACL guidance, random lease IDs, idempotent release, expiry. |
| Crash during stream | lease TTL recovery in HA; conservative capacity correction. |
| Config tampering/injection | strict unknown-field rejection, semantic validation, environment-name validation. |
Deploy with least-privilege identities, egress policy, rustls TLS, non-root/read-only containers, network policies, coordinator TLS/ACLs, and a private admin route. InferQoS cannot protect a host or configuration source already controlled by an attacker.