Internal Only By Convention

A header, query parameter, or environment input the framework defines as internal-IPC-only, read with security-relevant authority on every inbound network request. The "internal-only" contract is documentation, not enforcement.