# Runbook — enable `SOLACENET_GATEWAY_RAILS_ENFORCE` (gateway rails)

**Purpose:** Turn on SolaceNet capability checks for mutating gateway rail endpoints and related ingress (`/api/v1/gateway/rails/*` except `GET /rails` list, `POST /instructions`, `GET /events/replay`).

**Prerequisites**

- Policy engine / entitlements can resolve `gateway-microservices` for target tenants.
- Tenants that must use rails have **active entitlements** (or policy allow) for capability id **`gateway-microservices`**.
- Clients send **`x-tenant-id`** (or `tenantId` in JSON body where applicable). Optional default: set **`SOLACENET_DEFAULT_TENANT_ID`** in environment for lab only.

**Audit**

- Every allow/deny is logged as structured **`Gateway rails enforcement audit`** (Winston).
- Optional **NDJSON file:** set `SOLACENET_GATEWAY_AUDIT_LOG_PATH` to an operator-writable path; append-only, rotate externally.

**Steps**

1. **Seed or verify entitlements** for each production tenant that should call rail adapters.
2. Set environment on the API process:
   - `SOLACENET_GATEWAY_RAILS_ENFORCE=1` (or `true`)
   - Optionally `SOLACENET_DEFAULT_TENANT_ID=…` for single-tenant lab (not recommended for multi-tenant prod).
3. **Smoke test without entitlement:** call `GET /api/v1/gateway/rails/dbis.adapter.ktt-evidence/health` with a tenant that lacks the capability — expect **403** with a forbidden message.
4. **Smoke test with entitlement:** same call with an entitled tenant — expect **200** and health JSON.
5. **Confirm list endpoint:** `GET /api/v1/gateway/rails` remains **200** (metadata only; still requires normal API auth).

**Rollback**

- Unset `SOLACENET_GATEWAY_RAILS_ENFORCE` or set to `0` / `false` and restart the API.

**Related**

- `src/core/gateway/rails/gateway-rails-enforcement.ts`
- `dbis_core/.env.example` — SolaceNet gateway variables
- `AUDIT_GAPS_INCONSISTENCIES_MISSING.md` — SIEM/export pipelines beyond file + logs remain optional

**Version:** 1.0 · **Last updated:** 2026-04-07
