Defensive Architecture: Cisco Secure Workload API Bypass Logic

The vulnerability in Cisco Secure Workload stems from a failure in the API's authorization middleware. The system correctly identifies the user via a JWT but fails to perform a secondary check to ensure the user's role permits access to 'Site Admin' functions. An attacker can simply append a custom header or modify the JWT payload (if not properly signed) to escalate privileges.

GET /api/v1/site_admin/config HTTP/1.1
Host: workload-manager.internal
Authorization: Bearer [GUEST_TOKEN]
X-Override-Role: SiteAdmin

// Logic Flaw: Middleware checks for presence of token but fails to validate 
// the 'Role' claim against the requested endpoint, trusting the header override.

Implement 'Strict Role-Based Access Control' (RBAC) at the API gateway level. Every request must be validated against a centralized authorization server that maps the user's identity to specific resource permissions, regardless of the headers provided.