Add details on delegation mode

tratteria · Jul 26, 2024 · 82772f8 · 82772f8
1 parent 3264157
commit 82772f8
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/content/docs/_index.md b/content/docs/_index.md
@@ -38,6 +38,8 @@ Tratteria can operate in two modes:
 
 * **The Delegation Mode**: In this approach, the application explicitly calls the Tratteria Agent within its Kubernetes pod to verify TraTs. As a result, the application needs to make this change to its code to use Tratteria. This approach is more secure, because it does not suffer from the [sidecar bypass attack](https://github.com/istio/istio/discussions/48994) that Kubernetes sidecars in general suffer from. In addition, a delegation based approach allows the application to pack the call parameter information in the Txn-Token header, and can potentially eliminate having to send it separately through query parameters or the body.
 
+  This mode is suitable for environments where intercepting incoming requests is not possible or desired, for example, in environments with a service mesh that is already intercepting incoming requests.
+
 ## Tratteria Resource
 
 Tratteria lets you define how to generate the TraT for an external API and how to verify the TraT for the resulting internal requests of the external API using Kubernetes resources. Additionally, it supports specifying access evaluation for external APIs.

diff --git a/content/docs/generating-and-verifying-trats/_index.md b/content/docs/generating-and-verifying-trats/_index.md
@@ -178,6 +178,6 @@ In this mode, incoming requests are intercepted by the Tratteria agent, which ve
 
 #### Delegation Mode:
 
-In Delegation Mode, requests are not intercepted; instead, Tratteria agents' trat-verification API must be called with request data to verify TraTs. This mode is suitable for environments where intercepting requests is not possible or desired, for example, in environments with a service mesh that is already intercepting incoming requests.
+In Delegation Mode, requests are not intercepted; instead, Tratteria agents' trat-verification API must be called with request data to verify TraTs. This mode is suitable for environments where intercepting incoming requests is not possible or desired, for example, in environments with a service mesh that is already intercepting incoming requests.
 
 For details on how to verify TraTs using Tratteria agents, visit [Tratteria agents readme](https://github.com/tratteria/tratteria-agent).