routes.go registers POST/PATCH/DELETE on /api/maestro/v1/consumers and DELETE on /api/maestro/v1/resource-bundles/{id}. The middleware chain (NewAPIServer/registerApiMiddleware) applies only Metrics, Transaction, Compress, CORS, removeTrailingSlash, and otelhttp -- no JWT, TokenReview, or mTLS in the HTTP chain. The gRPC path has auth interceptors but the REST path does not, suggesting an asymmetric omission rather than deliberate delegation. The Helm chart ships no Istio AuthorizationPolicy, NetworkPolicy, or oauth-proxy, so authentication is entirely dependent on the deployment environment. With route.enabled=true (chart default), an OpenShift Route exposes unauthenticated write endpoints.

Maestro is a Tech Preview component in ACM. The TP status and expectation that users provide their own authentication layer are not documented in customer-facing materials.

Upstream repo: https://github.com/openshift-online/maestro
Jira: ACM-38752