maas-api performs no first-party authentication. The sole identity source for every protected route (/v1/tokens, /v1/api-keys, /v1/models) is the ExtractUserInfo() gin middleware, which reads X-MaaS-Username and X-MaaS-Group HTTP headers and trusts them verbatim. Without a NetworkPolicy restricting direct pod access, any pod in the cluster can bypass the Kuadrant AuthPolicy gateway and forge requests as any user — minting Kubernetes ServiceAccount tokens (TokenRequest) in other tenants' namespaces, revoking their API keys, and exfiltrating their model access configuration.