The runtime discovery API (/agntcy.dir.runtime.v1.DiscoveryService/*) lists which agents run where: host names, addresses, ports and SLIM names. dirctl daemon serves it on Directory's own gRPC server, and it will also be reachable through Directory's API server when dir-runtime is deployed with it (#2309). Today a broad read rule such as p,*,* or a trust-domain wildcard also grants it, so a Directory that is meant to be readable by anyone would expose its runtime inventory too.

Proposal

• Treat DiscoveryService like PolicyAuditService: only a rule whose subject is a SPIFFE ID grants it, and a trust-domain rule (including *) never does.
• Document the rule to name the callers allowed to list workloads, e.g. p,spiffe://example.org/ns/dir/sa/dirctl,/agntcy.dir.runtime.v1.DiscoveryService/*.
• Check that requests through the gateway reach the same authorization, so the runtime API can't be read through it without that rule.

Acceptance

• With only trust-domain rules (including p,*,*), ListWorkloads and GetWorkload are denied.
• With a SPIFFE-ID rule for the caller, they are allowed.
• The authorization docs list DiscoveryService among the methods granted only by SPIFFE ID.