API Key and Token Service  ·  View 17 of 22  ·  Act 6 · Operations

Release and Config Pipeline

How a scope vocabulary change reaches ten thousand verification points without being able to break them.

Editable source SVG draw.io All views
Propose Scope or policy PR declarative, versioned Registry owner review one vocabulary, one owner Check Vocabulary lint no synonyms, no removals Compatibility gate additive only Replay simulation yesterday's verifications Build Config artefact immutable, signed Provenance who built it, from what Stage Canary ring 3 services, 30 min Error-rate watch auto-rollback Roll out Ring 1 — internal 20% of fleet Ring 2 — general remainder Refuse unparseable keep last good Prove Config version per point spread is the alarm Last-good pin one command removal rejected regression Release and Config — how a scope vocabulary reaches production Application we own Person or role Decision point Data store Security / platform Risk / gap Opportunity failure / alternate A verification point that cannot parse a config keeps the last good one and reports it. It never falls back to permitting everything. v 1.0 · owner Security Platform Architecture · date 2026-09

Decisions

  • The scope vocabulary is additive-only and machine-linted: no removals, no synonyms. A removal is rejected at the gate rather than discovered when a customer's key stops working.
  • Replay simulation runs the previous day's verifications against the candidate vocabulary, so a change that alters any outcome is visible before it is built.
  • A verification point that cannot parse a config keeps the last good one and reports its version. It never falls back to permitting everything.

The failure this prevents

  • A poison config reaches every verification point at once, which makes it the fastest way to take the whole platform down. Ring rollout with automatic rollback is the containment, and config-version spread across the fleet is the alarm.

Open question

  • Central vocabulary ownership is assumed here, and it makes this pipeline a bottleneck on every product team. Federating it scales with the organisation and reliably produces three spellings of "read". Core Architecture Question 7, left open.
◀  Deployment Architecture All views Observability  ▶
Solution Architecture v1.0 · Google Cloud with open-source edge components · Security Platform Architecture · 2026-0917-config-and-release-pipeline