diff --git a/apiserver/apiserver.go b/apiserver/apiserver.go
index fae2dded218..b0eb75d3e6b 100644
--- a/apiserver/apiserver.go
+++ b/apiserver/apiserver.go
@@ -97,6 +97,11 @@ func (api *APIServer) ListenAndServe(ctx context.Context) error {
 
 	errors := make(chan error)
 	go func() {
+		// Plaintext HTTP (not ListenAndServeTLS) is intentional here, risk-accepted
+		// By-Design - see the authn/authz rationale in NewRouter (routers.go).
+		// This server is only reachable from the AKS RP control plane over the
+		// cluster-internal network; TLS termination/authentication is handled at
+		// the network boundary, not in this process.
 		errors <- svr.ListenAndServe()
 	}()
 
diff --git a/apiserver/routers.go b/apiserver/routers.go
index e5d199f4f9f..fe68cda2605 100644
--- a/apiserver/routers.go
+++ b/apiserver/routers.go
@@ -43,6 +43,27 @@ func (api *APIServer) NewRouter() *mux.Router {
 	router.Methods("GET").Path("/healthz").Name("healthz").HandlerFunc(healthz)
 
 	// global timeout and panic handlers.
+	//
+	// No authentication middleware (JWT/mTLS/API-key) is intentionally added here;
+	// this is a risk-accepted By-Design decision, not an oversight.
+	//
+	// Rationale:
+	//   - This APIServer is an internal sidecar invoked only by the AKS RP control
+	//     plane over the cluster-internal network; it is not exposed to the public
+	//     internet.
+	//   - The enforced security boundary is network isolation (pod/cluster network
+	//     policy), configured outside this repo in the RP deployment, not app-layer
+	//     auth.
+	//   - The handlers registered above are stateless template generators: they
+	//     render node bootstrap data / image config from request input and do not
+	//     read tenant secrets from a backend store.
+	//   - Adding real authentication (mTLS or token-based) would require a
+	//     cert/token issuance and rotation mechanism plus a coordinated change on
+	//     the RP caller side (a different repo/system) - out of scope for a
+	//     point fix here.
+	//
+	// If this router is ever exposed beyond the trusted RP-only network boundary,
+	// authentication middleware must be added here.
 	router.Use(timeoutHandler(), recoveryHandler())
 
 	return router