Documentation / QueryTek Tapestry glossary / Constrained Relay
A constrained relay forwards a request between two systems while permitting only the operations policy has explicitly allowed. It is a deliberately narrow crossing point: anything not on the permitted list is refused, so the relay cannot become a general-purpose tunnel between environments.
When two systems must exchange work but neither should have open access to the other, the tempting solution is a proxy. The problem with a general proxy is that it grants whatever the underlying connection allows; its scope is defined by what the network permits rather than by what was agreed.
A constrained relay inverts that default. The set of permitted operations is enumerated, and the relay refuses everything else.
Deny by default. Absence of a rule is a refusal, not a gap. Adding a capability is an explicit act with an owner, rather than a side effect of a connection already being open.
Narrow surface. The relay exposes the specific operations a partnership needs. This keeps a compromise at one end from becoming reach into the other, because the reachable surface is small and known.
Mediated, not transparent. Traffic is examined and re-issued rather than passed through untouched, which is what makes the crossing a place where policy can be applied and recorded.
The distinction from a firewall allowlist is the layer. A network allowlist answers which hosts may connect; a constrained relay answers which actions may be taken once connected. Systems commonly have the first control and lack the second, which is how an authorized connection ends up permitting far more than anyone intended.
Constraint is also what makes the crossing reviewable. A short, declared list of permitted operations can be read and reasoned about; the effective permissions of an open tunnel cannot.
Partner integrations are a standard route for lateral movement precisely because they are trusted. A relay whose permitted actions are enumerated limits what a compromised partner can attempt, which is a materially different risk position from a trusted connection with broad reach.
It also makes the arrangement explainable. "What can this partner do" has a short answer, which is what a security review actually asks for.
QueryTek Tapestry keeps cross-boundary forwarding narrow and policy-bound so a partner connection grants specific operations rather than general access. Relay internals, permitted-operation catalogues, and partner-specific bounds are established during onboarding and are not published, since publishing the permitted surface would describe the attack surface.
