API Key and Token Service  ·  View 08 of 22  ·  Act 3 · Structure

Verification Data Plane

What actually sits inside a calling service's pod, and what is deliberately not reachable from it.

Editable source SVG draw.io All views
A calling service's pod — the common case Application container Product service any language Authorization context tenant, scopes, staleness Verification sidecar ext_authz filter Envoy Digest map active credentials Revocation overlay monotonic Pepper version cached, KMS-backed Staleness guard fail closed at 120 s Telemetry emitter 1% success, 100% denial Thin clients that cannot hold state Verification API regional, p99 ≤ 15 ms Shared projection Memorystore Revocation feed push + 5 s poll Regional snapshot Cloud Storage localhost lookup check deny if stale context revocations Verification Data Plane — what sits inside a calling service Application we own Interface / broker Data store Security / platform Decision point Queue / topic synchronous failure / alternate event / async The regional snapshot warms a cold projection at start-up; that edge is omitted here because it never runs on the request path. No arrow on this page reaches the credential store. v 1.0 · owner Security Platform Architecture · date 2026-09

The critical absence

  • There is no edge on this page to the credential store. A cold read to Spanner on the request path is the failure this design exists to prevent, and it would appear first as a latency regression and later as a correlated outage.
  • The pepper is cached in the sidecar by version, so KMS being unreachable stops issuance and not verification.

Open question

  • Full projection or demand-filled cache? A full replica of 2.5 million records is roughly 400 MB per point at the assumed record size — affordable for a few hundred fleet-wide sidecars, not for a few thousand. The set assumes full projection and names the memory ceiling as the trigger to revisit.

Risks

  • Constant-cost miss handling matters: a faster "not found" than "found" leaks which key identifiers exist.
  • The remote verification API is the escape hatch for thin clients and is the one place a network hop returns. It is bounded at p99 ≤ 15 ms and is not the intended path.
◀  Control Plane Components All views Integration Surface  ▶
Solution Architecture v1.0 · Google Cloud with open-source edge components · Security Platform Architecture · 2026-0908-verification-data-plane