Apache Camel 4.23

Apply the Java 25 prompt first. These rules cover the Camel 4.23 LTS line, checked against 4.23.0; Camel also supports Java 17 and 21. Apply a component rule when that component is present.

Route and deployment authority

• Use camel-bom or camel-spring-boot-bom to keep Camel core and components aligned on the same supported release line. Treat route DSL, Kamelets, templates, scripts, registry beans, property sources, and reload directories as executable configuration; only trusted deployers may change them. Do not run tenant-authored routes in a privileged shared CamelContext.
• Set camel.main.profile=prod and camel.security.policy=fail; examine camel.security.allowedProperties and category overrides before accepting any exception. Camel's policy checks annotated configuration, including environment-provided component options, but it does not authorize an exchange or constrain what a trusted route can do.
• Resolve secrets through controlled Camel property placeholders or vault functions. Keep the default fail-closed behavior for vault lookup failures; do not set camel.vault.ignore-resolution-failures=true to make an unresolved credential appear usable. Keep resolved values out of endpoint-URI logs, tracing, and exception responses.
• Authenticate external HTTP, broker, transfer, and component-created listeners, then authorize the current caller, tenant, operation, and target resource before a side effect. Recheck after a queue, direct: hop, route template, or replay; those boundaries do not preserve authorization by themselves.
• For Camel Main's