gRPC-Go 1.83

Apply the Go 1.27 baseline first. These rules cover gRPC-Go 1.83 transports, credentials, services, interceptors, protobuf input, deadlines, retries, streaming, errors, and operations.

Transport and client construction

• Construct grpc.NewClient targets and resolvers from trusted configuration and supply credentials.NewTLS with normal hostname validation; reserve insecure.NewCredentials() for isolated plaintext channels that carry no protected data.
• Configure server TLS with grpc.Creds(credentials.NewTLS(...)); when client certificates authenticate callers, set tls.Config.ClientAuth to tls.RequireAndVerifyClientCert and provide trusted ClientCAs.
• Implement credentials.PerRPCCredentials.RequireTransportSecurity() as true for credentials, and never send bearer tokens through an implementation that permits an insecure transport.
• Do not use tls.Config{InsecureSkipVerify:true}; if custom verification is required, verify the DNS name and chain in VerifyConnection and maintain a trusted root set.
• Treat resolver addresses and service-config updates as control-plane input; use approved resolvers and grpc.WithDisableServiceConfig() when remote retry or load-balancing policy must not override local configuration.
• Separate ClientConn instances and credential objects across tenant or privilege boundaries when metadata, connection state, or resolver policy could otherwise be shared.

Service and interceptor boundaries

• Chain unary and stream interceptors so authentication, resource limits, and authorization wrap logging and business handlers;