> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Platform IP allowlist enforcement contract

> Platform now documents the trusted-proxy boundary and the enforcement behavior of IP allowlists.

<Badge stroke icon="calendar-days" iconType="regular">August 26, 2026</Badge> <Badge stroke icon="file-code" iconType="regular">Documentation correction</Badge> <Badge color="red" size="lg" stroke icon="triangle-exclamation" iconType="regular">Action required</Badge>

## Affects

***

Teams that configure IP allowlists for Platform services behind a reverse proxy, load balancer, or CDN.

## What changed

***

IP allowlists determine the client address from `X-Forwarded-For` only when the direct peer is in the configured trusted-proxy CIDRs. A non-empty allowlist is enforced only for a selected `console` or `api` scope; a list with neither scope is inert. A resolved client IP that is not allowed is denied with HTTP 403. A missing or unusable client IP is also denied, unless the request's transport peer is in `PLATFORM_INTERNAL_CIDRS`. If no allowlist is configured, the middleware allows the request.

This is a documentation correction of existing enforcement behavior; it does not announce a runtime release.

## Impact

***

**Classification: Action required.** A missing or incorrect trusted-proxy CIDR can cause legitimate traffic to be denied or make forwarded client IPs untrustworthy.

## What you need to do

***

<Steps>
  <Step>Configure only the CIDRs of proxies that directly connect to the service as trusted proxies.</Step>
  <Step>Test allowed and denied requests through the production proxy chain before enabling an allowlist.</Step>
  <Step>Do not trust `X-Forwarded-For` from direct clients or from an untrusted proxy.</Step>
</Steps>

### Deadline

Validate before enabling or changing an IP allowlist.