API Key and Token Service  ·  View 20 of 22  ·  Act 7 · Assurance

Security Trust Zones

Six zones, and the two crossings that do not exist.

Editable source SVG draw.io All views
Internet — untrusted Holder of a leaked key Customer application Scanning partner unauthenticated Developer browser Perimeter Cloud Armor prefix brute-force limits Global load balancer Partner endpoint one bit, hard quota Product workloads Product services Verification sidecar holds digests, not secrets Credential control plane Issuance and rotation mTLS only Revocation intake Console backend IAP + step-up Credential state Credential store digests only Audit store append-only, chained Key custody — separate blast radius Cloud KMS / HSM pepper never leaves credential candidate throttled request no call — by design tenant-scoped query digest request Trust Zones — what crosses each boundary, and what never does Risk / gap External / third party Security / platform Interface / broker Application we own Data store synchronous failure / alternate Two crossings define the design: the sidecar never reaches the control plane, and the pepper never leaves KMS. A database exfiltration crosses neither. v 1.0 · owner Security Platform Architecture · date 2026-09

The two absences

  • The verification sidecar never reaches the control plane. Drawn as a refused crossing because it is the design's central claim, and a future change that adds that call would quietly undo the architecture.
  • The pepper never leaves the key custody zone. An exfiltration of the credential store therefore crosses no boundary that matters: it yields digests and no usable credentials.

Decisions

  • Tenant isolation is enforced at the data layer, not in application code: a query without a tenant predicate is not expressible.
  • The holder of a leaked key is drawn as a first-class actor in the untrusted zone, because they are the threat the architecture is shaped around — not an abstraction.

Risk

  • Online brute force against the key prefix is throttled and alerted, but the real defence is 160 bits of entropy. If that assumption is ever weakened, nothing else on this page compensates.
◀  Credential Lifecycle All views Identity and Access  ▶
Solution Architecture v1.0 · Google Cloud with open-source edge components · Security Platform Architecture · 2026-0920-security-trust-zones