# Boundary protection

URL: /systems/trust-and-governance/controls/boundary-protection · Id: `control:boundary-protection`

> Every inbound request passes authentication and rate Limits, and every outbound call leaves through the gateway.

Every inbound request passes authentication and rate [Limits](/business/nouns/limit), and every outbound call leaves through the gateway.

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 CC6.6](/systems/trust-and-governance/criteria/soc2/cc6-6) | The entity implements logical access security measures against threats from sources outside its system boundaries. |
| [ISO27001 A.8.20](/systems/trust-and-governance/criteria/iso27001/a-8-20) | Networks and network devices are secured, managed and controlled to protect the information they carry. |

## Implemented by
- [Security](/workflows/processes/security)
- [Rate limits](/code/platform/rate-limits)
- [Integrations](/code/platform/integrations)

## Test
| Step | Rule |
| --- | --- |
| Kind | Preventive: it stops the failure before it happens. |
| Select | Every inbound request and outbound upstream call in the report period. |
| Assert | Each inbound request passed authentication and its rate Limit, and each outbound call has a gateway record. |

## Owner
[Security Engineer](/agents/engineering/security-engineer), [Engineering Team](/agents/engineering).

## Example
A scraper sends 2,000 requests a minute to a currency-conversion API. Requests past the rate Limit get 429, and the API's own call to its rate source leaves through the gateway with a record.