Microsoft Orleans 10

Apply the C# 14 prompt first. These rules cover Microsoft Orleans 10 on .NET 10, including silos, clients, grains, serialization, persistence, transactions, streams, reminders, and the official dashboard.

Cluster trust and deployment

• Place public callers behind an application HTTP, gRPC, or messaging boundary that authenticates, authorizes, validates, and rate limits before making grain calls. Any connected Orleans client with compatible contracts can address known grain types and keys.
• Configure ClusterOptions.ServiceId, ClusterId, provider names, and advertised/listening endpoints from trusted deployment configuration. Keep ServiceId stable for the application and use distinct ClusterId values for separate deployments; neither value authenticates a member or caller.
• Restrict silo ports to approved silos and gateway ports to approved client workloads, including every advertised endpoint. Use separate processes, clusters, provider accounts, and network policies when tenants require a security boundary; grains in one silo share its process privileges.
• Grant clients only the gateway-discovery access their provider requires, and grant silos only their membership, state, reminder, and stream operations. Configure provider authentication, TLS, encryption at rest, and isolated namespaces independently of Orleans transport security.
• Align Orleans runtime, client, SDK, provider, serializer, and dashboard package versions. Before rolling deployment, verify grain contracts, type policies, and existing persisted/queued data against every version participating