[ { "id": "01-system-context", "title": "API Key and Token Service — System Context", "layout": "context", "canvas": { "width": 1700 }, "system": { "label": "API Key and Token Service", "sub": "Issue · verify · revoke" }, "colWidth": 270, "groups": [ { "side": "left", "title": "People", "nodes": [ { "id": "dev", "label": "Customer developer", "kind": "actor", "rel": "creates, rotates", "dir": "in" }, { "id": "secops", "label": "Customer security", "kind": "actor", "rel": "revokes, audits", "dir": "in" }, { "id": "support", "label": "Platform support", "kind": "actor", "rel": "investigates", "dir": "in" } ] }, { "side": "right", "title": "Callers of the verification API", "nodes": [ { "id": "svc", "label": "Platform services", "kind": "app", "rel": "every request", "dir": "in" }, { "id": "gw", "label": "Public API gateway", "kind": "integration", "rel": "verify at the edge", "dir": "in" }, { "id": "jobs", "label": "Async workers", "kind": "app", "rel": "verify on replay", "dir": "in" }, { "id": "scanner", "label": "Scanning partners", "kind": "external", "sub": "public repo hosts", "rel": "live-or-not", "dir": "in" } ] }, { "side": "top", "title": "Trust anchors", "nodes": [ { "id": "idp", "label": "Platform IdP", "kind": "security", "sub": "console + workload identity", "rel": "authenticates", "dir": "in" }, { "id": "kms", "label": "Cloud KMS / HSM", "kind": "security", "sub": "digest pepper", "rel": "pepper", "dir": "in" } ] }, { "side": "bottom", "title": "Outside the boundary", "nodes": [ { "id": "siem", "label": "Tenant SIEM", "kind": "external", "rel": "export", "kind2": "batch" }, { "id": "billing", "label": "Billing and metering", "kind": "external", "rel": "usage", "kind2": "async" }, { "id": "authz", "label": "Product authorization", "kind": "external", "sub": "out of scope", "rel": "scope → policy", "kind2": "sync" } ] } ], "note": "The service reports what a credential carries. It never decides what that permits — product authorization does, and sits outside this boundary.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "02-high-level-architecture", "title": "High-Level Architecture — from issuance to a dead key", "layout": "flow", "canvas": { "width": 1760 }, "chain": true, "align": "middle", "stages": [ { "title": "Issue", "nodes": [ { "id": "console", "label": "Developer console", "kind": "app", "sub": "Cloud Run" }, { "id": "mgmt", "label": "Management API", "kind": "integration", "sub": "GKE" } ] }, { "title": "Record", "nodes": [ { "id": "store", "label": "Credential store", "kind": "store", "sub": "Cloud Spanner" }, { "id": "pepper", "label": "Digest pepper", "kind": "security", "sub": "Cloud KMS HSM" } ] }, { "title": "Distribute", "nodes": [ { "id": "revlog", "label": "Revocation log", "kind": "store", "sub": "append-only, ordered" }, { "id": "feed", "label": "Revocation feed", "kind": "queue", "sub": "Pub/Sub + poll" }, { "id": "snap", "label": "Snapshot objects", "kind": "store", "sub": "Cloud Storage" } ] }, { "title": "Verify", "nodes": [ { "id": "point", "label": "Verification point", "kind": "app", "sub": "sidecar or library" }, { "id": "proj", "label": "Local projection", "kind": "store", "sub": "digest map + overlay" }, { "id": "stale", "label": "Staleness guard", "kind": "decision", "sub": "120 s ceiling" } ] }, { "title": "Observe", "nodes": [ { "id": "counters", "label": "Usage counters", "kind": "store", "sub": "Bigtable" }, { "id": "audit", "label": "Audit store", "kind": "store", "sub": "BigQuery + GCS" } ] }, { "title": "Contain", "nodes": [ { "id": "leak", "label": "Leak response", "kind": "security", "sub": "revoke · downgrade · quarantine" }, { "id": "canary", "label": "Revocation canary", "kind": "platform", "sub": "issue → revoke → re-verify" } ] } ], "edges": [ { "from": "mgmt", "to": "store", "label": "write record" }, { "from": "mgmt", "to": "pepper", "label": "digest", "kind": "sync" }, { "from": "store", "to": "revlog", "label": "revocation intake" }, { "from": "feed", "to": "proj", "kind": "async" }, { "from": "snap", "to": "proj", "label": "warm start", "kind": "batch" }, { "from": "point", "to": "counters", "label": "sampled use", "kind": "async" }, { "from": "leak", "to": "revlog", "label": "bulk revoke", "kind": "error" }, { "from": "canary", "to": "feed", "label": "measures p99", "kind": "async" } ], "note": "The verification stage makes no call to the issue or record stages. That is the architecture.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "03-actors-and-journeys", "title": "Who this is for, and what each of them gets to do", "layout": "actors", "canvas": { "width": 1740 }, "cardWidth": 280, "groups": [ { "title": "Customer engineering", "kind": "boundary", "actors": [ { "id": "dev", "label": "Integrating developer", "sub": "40,000 / month", "goal": "Get a working key, paste it into my app, and make a real call before my coffee goes cold.", "journeys": [ { "id": "j-first", "label": "First successful API call", "sub": "≤ 2 min at p50" }, { "label": "Add a key per environment" } ] }, { "id": "owner", "label": "Service owner on call", "sub": "one per integration", "goal": "Rotate a key without taking my own production down, and prove the old one is idle before I kill it.", "journeys": [ { "label": "Rotate with an overlap window" }, { "label": "Retire a key nobody uses" } ] } ] }, { "title": "Customer security and governance", "kind": "trust", "actors": [ { "id": "secops", "label": "Customer security engineer", "sub": "1 per 12 developers", "goal": "When a key is on the internet, kill it everywhere in seconds and tell me exactly what it did before I did.", "journeys": [ { "id": "j-leak", "label": "Contain a leaked key", "sub": "≤ 60 s to action" }, { "label": "Review keys with no owner" }, { "label": "Export the audit trail" } ] } ] }, { "title": "Platform side", "kind": "cloud", "actors": [ { "id": "svcowner", "label": "Platform service owner", "kind": "app", "sub": "180 services", "goal": "Verify every request without adding a network hop, and know how stale my answer is.", "journeys": [ { "label": "Embed the verification library" }, { "label": "Read the staleness signal" } ] }, { "id": "sre", "label": "Platform SRE", "kind": "actor", "sub": "follow-the-sun", "goal": "See revocation propagation as a live number, not as a promise in a design document.", "journeys": [ { "label": "Watch the revocation canary" }, { "label": "Run a regional failover" } ] } ] }, { "title": "Machines and outsiders", "kind": "plain", "actors": [ { "id": "scanner", "label": "Scanning partner", "kind": "external", "sub": "3 integrated hosts", "goal": "Tell me whether this string I found in a public commit is live, and nothing else about it.", "journeys": [ { "label": "Confirm a candidate string" } ] }, { "id": "ci", "label": "Customer CI system", "kind": "platform", "sub": "automated issuance", "goal": "Mint a scoped, short-lived credential per deploy and never store a long-lived one.", "journeys": [ { "label": "Mint a per-deploy token" } ] } ] } ], "note": "Two journeys carry the value and get their own map: the first call, and the leaked key.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "04-journey-first-api-call", "title": "Journey — integrating developer, signup to first call", "layout": "journey", "canvas": { "width": 1740 }, "actor": { "label": "Integrating developer", "sub": "evaluating the platform", "goal": "Make one real API call today and decide whether to keep going", "trigger": "A tutorial, a colleague's recommendation, or a spike due Friday", "success": "A 200 response in their own terminal, from their own key" }, "phases": [ { "title": "Sign up", "sub": "no key yet" }, { "title": "Create a key", "moment": true }, { "title": "Copy it", "moment": true }, { "title": "First call" }, { "title": "Go to production", "moment": true } ], "lanes": [ { "title": "What they do", "kind": "step", "cells": [ [ { "label": "Creates an account" } ], [ { "label": "Picks scopes" }, { "label": "Names the key" } ], [ { "label": "Copies the secret" } ], [ { "label": "Pastes into curl" } ], [ { "label": "Moves key to CI" }, { "label": "Adds a live key" } ] ] }, { "title": "What the platform does", "kind": "system", "cells": [ [ { "label": "Issues a test key", "kind": "system" } ], [ { "label": "Scope picker defaults narrow", "kind": "system" } ], [ { "label": "Shows secret once", "kind": "system" } ], [ { "label": "Verifies locally", "kind": "system" } ], [ { "label": "Warns on scope width", "kind": "system" } ] ] }, { "title": "How it feels", "kind": "emotion", "levels": [ "Delighted", "Fine", "Frustrated" ], "points": [ 2, 1, 0, 2, 1 ] }, { "title": "Where it hurts", "kind": "pain", "cells": [ [], [ { "label": "Which scopes do I need?" } ], [ { "label": "Lost the secret, must re-create" } ], [], [ { "label": "Test key silently fails on live" } ] ] }, { "title": "What we do about it", "kind": "gain", "cells": [ [], [ { "label": "Scope presets per use case" } ], [ { "label": "Rotate-in-place, not delete" } ], [], [ { "label": "Environment in the prefix" } ] ] } ], "chain": true, "note": "The trough is the one-time secret display. It is deliberate, and rotation is what makes it survivable.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "05-journey-key-on-github", "title": "Journey — customer security engineer, a live key in a public commit", "layout": "journey", "canvas": { "width": 1740 }, "actor": { "label": "Customer security engineer", "sub": "paged at 21:40", "goal": "Make the leaked credential useless before anyone else uses it", "trigger": "A scanning partner matched the key prefix in a public commit", "success": "The key is dead everywhere, and the blast radius is written down" }, "phases": [ { "title": "Leak", "sub": "commit pushed" }, { "title": "Detect" }, { "title": "Decide", "moment": true }, { "title": "Contain", "moment": true }, { "title": "Account for it" } ], "lanes": [ { "title": "What they do", "kind": "step", "cells": [ [], [ { "label": "Reads the alert" } ], [ { "label": "Checks blast radius" }, { "label": "Confirms revoke" } ], [ { "label": "Watches propagation" } ], [ { "label": "Exports the trail" }, { "label": "Issues a successor" } ] ] }, { "title": "What the platform does", "kind": "system", "cells": [ [ { "label": "Key is live and usable", "kind": "risk" } ], [ { "label": "Partner live-or-not check", "kind": "system" } ], [ { "label": "Policy: revoke or downgrade", "kind": "decision" } ], [ { "label": "Feed reaches every point", "kind": "system" } ], [ { "label": "Full decision trail", "kind": "system" } ] ] }, { "title": "How it feels", "kind": "emotion", "levels": [ "In control", "Tense", "Losing it" ], "points": [ null, 0, 0, 1, 2 ] }, { "title": "Where it hurts", "kind": "pain", "cells": [ [ { "label": "Nobody knows yet" } ], [ { "label": "Is this our key or a test one?" } ], [ { "label": "Revoking breaks production" } ], [ { "label": "Is it dead everywhere yet?" } ], [ { "label": "What did it touch?" } ] ] }, { "title": "What we do about it", "kind": "gain", "cells": [ [ { "label": "Prefix makes it greppable" } ], [ { "label": "Environment in the prefix" } ], [ { "label": "Downgrade to read-only" } ], [ { "label": "Propagation shown live, p99 ≤ 10 s" } ], [ { "label": "Usage attributed per key" } ] ] } ], "chain": true, "note": "The trough is Decide, not Detect. The revoke button is easy; the blast-radius answer is what makes pressing it possible.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "06-layered-architecture", "title": "Layered Architecture — the control plane writes, the data plane reads", "layout": "bands", "canvas": { "width": 1700 }, "layerHeaderWidth": 170, "bands": [ { "name": "Experience", "nodes": [ { "id": "console", "label": "Developer console", "kind": "app", "sub": "keys, scopes, rotation" }, { "id": "mgmtapi", "label": "Management API", "kind": "integration", "sub": "REST, tenant-scoped" }, { "id": "partner", "label": "Partner check endpoint", "kind": "integration", "sub": "live-or-not only" } ] }, { "name": "Control plane", "nodes": [ { "id": "issue", "label": "Issuance", "kind": "app", "sub": "entropy, digest, quota" }, { "id": "scopesvc", "label": "Scope registry", "kind": "app", "sub": "versioned vocabulary" }, { "id": "rotate", "label": "Rotation and expiry", "kind": "app", "sub": "overlap windows" }, { "id": "revoke", "label": "Revocation intake", "kind": "security", "sub": "single and bulk" }, { "id": "policy", "label": "Leak-response policy", "kind": "security", "sub": "per tenant, per class" } ] }, { "name": "Propagation", "nodes": [ { "id": "revlog", "label": "Revocation log", "kind": "store", "sub": "append-only, ordered" }, { "id": "feed", "label": "Revocation feed", "kind": "queue", "sub": "push + poll fallback" }, { "id": "snapgen", "label": "Snapshot builder", "kind": "app", "sub": "per region, 60 s" }, { "id": "heartbeat", "label": "Staleness heartbeat", "kind": "platform", "sub": "proves the feed lives" } ] }, { "name": "Data plane", "nodes": [ { "id": "lib", "label": "Verification library", "kind": "app", "sub": "in-process" }, { "id": "sidecar", "label": "Verification sidecar", "kind": "app", "sub": "Envoy ext_authz" }, { "id": "remote", "label": "Verification API", "kind": "integration", "sub": "fallback for thin clients" }, { "id": "guard", "label": "Staleness guard", "kind": "decision", "sub": "fail closed at 120 s" } ] }, { "name": "State", "nodes": [ { "id": "cred", "label": "Credential store", "kind": "store", "sub": "Cloud Spanner" }, { "id": "counters", "label": "Usage counters", "kind": "store", "sub": "Bigtable, lossy" }, { "id": "audit", "label": "Audit store", "kind": "store", "sub": "BigQuery + GCS" } ] }, { "name": "Cryptographic base", "nodes": [ { "id": "kms", "label": "Cloud KMS / HSM", "kind": "security", "sub": "versioned pepper" }, { "id": "cmek", "label": "Envelope keys", "kind": "security", "sub": "per tenant" }, { "id": "wi", "label": "Workload identity", "kind": "security", "sub": "mTLS between planes" } ] } ], "edges": [ { "from": "mgmtapi", "to": "issue", "label": "issue" }, { "from": "issue", "to": "cred", "label": "record" }, { "from": "revoke", "to": "revlog", "label": "append" }, { "from": "revlog", "to": "feed", "label": "publish", "kind": "async" }, { "from": "feed", "to": "sidecar", "label": "overlay", "kind": "async" }, { "from": "snapgen", "to": "lib", "label": "warm start", "kind": "batch" }, { "from": "sidecar", "to": "counters", "label": "sampled", "kind": "async" } ], "note": "Nothing in the data plane draws an arrow upward. A verification never calls the control plane.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "07-control-plane-components", "title": "Control Plane — components and boundaries", "layout": "nested", "canvas": { "width": 1720 }, "boxes": [ { "title": "Google Cloud — control-plane project", "kind": "cloud", "dir": "col", "children": [ { "title": "Edge and identity", "kind": "trust", "nodes": [ { "id": "lb", "label": "Global load balancer", "kind": "integration", "sub": "Cloud Armor" }, { "id": "iap", "label": "Console access", "kind": "security", "sub": "IAP + step-up" }, { "id": "wi", "label": "Workload identity", "kind": "security", "sub": "no static creds" } ] }, { "title": "Credential services — GKE", "kind": "boundary", "dir": "row", "children": [ { "title": "Lifecycle", "kind": "plain", "nodes": [ { "id": "issue", "label": "Issuance service", "kind": "app", "sub": "entropy + digest" }, { "id": "rotate", "label": "Rotation service", "kind": "app", "sub": "overlap, expiry" }, { "id": "quota", "label": "Quota and exemptions", "kind": "app", "sub": "250 live default" } ] }, { "title": "Authority", "kind": "plain", "nodes": [ { "id": "scope", "label": "Scope registry", "kind": "app", "sub": "versioned vocabulary" }, { "id": "revoke", "label": "Revocation intake", "kind": "security", "sub": "single and bulk" }, { "id": "resp", "label": "Leak-response engine", "kind": "security", "sub": "policy per tenant" } ] }, { "title": "Distribution", "kind": "plain", "nodes": [ { "id": "snapgen", "label": "Snapshot builder", "kind": "app", "sub": "regional, 60 s" }, { "id": "pub", "label": "Feed publisher", "kind": "queue", "sub": "Pub/Sub" }, { "id": "hb", "label": "Heartbeat emitter", "kind": "platform", "sub": "liveness of the feed" } ] } ] }, { "title": "State", "kind": "boundary", "nodes": [ { "id": "cred", "label": "Credential store", "kind": "store", "sub": "Spanner, tenant-partitioned" }, { "id": "revlog", "label": "Revocation log", "kind": "store", "sub": "append-only" }, { "id": "auditdb", "label": "Audit store", "kind": "store", "sub": "chained records" }, { "id": "kms", "label": "Cloud KMS / HSM", "kind": "security", "sub": "pepper, envelope keys" } ] } ] } ], "outside": [ { "id": "idp", "label": "Platform IdP", "kind": "external", "sub": "console + machine auth" }, { "id": "scanner", "label": "Scanning partner", "kind": "external", "sub": "rate-limited, live-or-not" } ], "edges": [ { "from": "lb", "to": "issue", "label": "management API" }, { "from": "issue", "to": "cred", "label": "write" }, { "from": "revoke", "to": "revlog", "label": "append" }, { "from": "scanner", "to": "resp", "label": "candidate string" } ], "note": "Four edges of many. Every lifecycle service also writes the audit store and reads the pepper from KMS; the feed publisher's read of the revocation log is view 14's subject and is omitted here.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "08-verification-data-plane", "title": "Verification Data Plane — what sits inside a calling service", "layout": "nested", "canvas": { "width": 1720 }, "boxes": [ { "title": "A calling service's pod — the common case", "kind": "boundary", "dir": "row", "children": [ { "title": "Application container", "kind": "plain", "nodes": [ { "id": "app", "label": "Product service", "kind": "app", "sub": "any language" }, { "id": "ctx", "label": "Authorization context", "kind": "app", "sub": "tenant, scopes, staleness" } ] }, { "title": "Verification sidecar", "kind": "trust", "nodes": [ { "id": "extauthz", "label": "ext_authz filter", "kind": "integration", "sub": "Envoy" }, { "id": "digestmap", "label": "Digest map", "kind": "store", "sub": "active credentials" }, { "id": "overlay", "label": "Revocation overlay", "kind": "store", "sub": "monotonic" }, { "id": "pepper", "label": "Pepper version", "kind": "security", "sub": "cached, KMS-backed" }, { "id": "guard", "label": "Staleness guard", "kind": "decision", "sub": "fail closed at 120 s" }, { "id": "emit", "label": "Telemetry emitter", "kind": "platform", "sub": "1% success, 100% denial" } ] } ] }, { "title": "Thin clients that cannot hold state", "kind": "boundary", "nodes": [ { "id": "remote", "label": "Verification API", "kind": "integration", "sub": "regional, p99 ≤ 15 ms" }, { "id": "remotecache", "label": "Shared projection", "kind": "store", "sub": "Memorystore" } ] } ], "outside": [ { "id": "feed", "label": "Revocation feed", "kind": "queue", "sub": "push + 5 s poll" }, { "id": "snap", "label": "Regional snapshot", "kind": "store", "sub": "Cloud Storage" } ], "edges": [ { "from": "app", "to": "extauthz", "label": "localhost" }, { "from": "extauthz", "to": "digestmap", "label": "lookup" }, { "from": "extauthz", "to": "overlay", "label": "check" }, { "from": "guard", "to": "extauthz", "label": "deny if stale", "kind": "error" }, { "from": "extauthz", "to": "ctx", "label": "context" }, { "from": "feed", "to": "overlay", "label": "revocations", "kind": "async" }, { "from": "extauthz", "to": "pepper" } ], "note": "The regional snapshot warms a cold projection at start-up; that edge is omitted here because it never runs on the request path. No arrow on this page reaches the credential store.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "09-integration-surface", "title": "Integration Surface — every interface the service exposes or uses", "layout": "hub", "canvas": { "width": 1720 }, "left": { "title": "Consumers", "nodes": [ { "id": "console", "label": "Developer console", "kind": "app", "rel": "session" }, { "id": "cust", "label": "Customer CI", "kind": "external", "rel": "mint" }, { "id": "svc", "label": "Platform services", "kind": "app", "rel": "verify" }, { "id": "scanner", "label": "Scanning partner", "kind": "external", "rel": "live-or-not" } ] }, "centre": { "title": "API Key and Token Service", "nodes": [ { "id": "mgmt", "label": "Management API", "kind": "integration", "sub": "issue, scope, rotate, revoke" }, { "id": "verify", "label": "Verification interface", "kind": "integration", "sub": "library, sidecar, API" } ] }, "right": { "title": "Dependencies and sinks", "nodes": [ { "id": "kms", "label": "Cloud KMS / HSM", "kind": "security", "rel": "pepper", "dir": "out" }, { "id": "spanner", "label": "Credential store", "kind": "store", "rel": "records", "dir": "out" }, { "id": "siem", "label": "Tenant SIEM", "kind": "external", "rel": "export", "dir": "out", "kind2": "batch" } ] }, "note": "Four inbound interfaces, three outbound. Lifecycle webhooks and metering are emitted, not called, and appear in views 14 and 18. The partner endpoint is the only unauthenticated interface, and it answers a single bit.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "10-storage-zones", "title": "Storage Zones — by what each store is authoritative for", "layout": "nested", "canvas": { "width": 1720 }, "boxes": [ { "title": "Authoritative — losing it is losing the service", "kind": "trust", "dir": "row", "children": [ { "title": "Credential truth", "kind": "boundary", "nodes": [ { "id": "cred", "label": "Credential record", "kind": "store", "sub": "Spanner · RPO ≤ 5 s" }, { "id": "scope", "label": "Scope vocabulary", "kind": "store", "sub": "versioned, immutable" } ] }, { "title": "Revocation truth", "kind": "boundary", "nodes": [ { "id": "revlog", "label": "Revocation log", "kind": "store", "sub": "append-only · RPO 0" }, { "id": "epoch", "label": "Tenant epoch", "kind": "store", "sub": "bulk revocation cut" } ] } ] }, { "title": "Evidential — rebuildable from nothing, but not re-creatable", "kind": "boundary", "dir": "row", "children": [ { "title": "Audit", "kind": "plain", "nodes": [ { "id": "audithot", "label": "Audit hot tier", "kind": "store", "sub": "BigQuery · 400 days" }, { "id": "auditcold", "label": "Audit archive", "kind": "store", "sub": "GCS · 7 years, locked" } ] }, { "title": "Telemetry", "kind": "plain", "nodes": [ { "id": "verifylog", "label": "Verification events", "kind": "store", "sub": "30 days · sampled" }, { "id": "counters", "label": "Usage counters", "kind": "store", "sub": "Bigtable · lossy" } ] } ] }, { "title": "Derived — throw it away and it rebuilds itself", "kind": "plain", "dir": "row", "children": [ { "title": "Distribution artefacts", "kind": "plain", "nodes": [ { "id": "snap", "label": "Regional snapshot", "kind": "store", "sub": "GCS · 60 s cadence" }, { "id": "proj", "label": "Local projection", "kind": "store", "sub": "in memory" }, { "id": "shared", "label": "Shared projection", "kind": "store", "sub": "Memorystore" } ] } ] }, { "title": "Never stored, anywhere, in any tier", "kind": "trust", "nodes": [ { "id": "secret", "label": "The credential secret", "kind": "risk", "sub": "shown once, then only its digest" }, { "id": "pepperbox", "label": "Digest pepper", "kind": "security", "sub": "KMS/HSM only — never in a backup" } ] } ], "edges": [ { "from": "cred", "to": "snap", "label": "projected", "kind": "batch" }, { "from": "revlog", "to": "proj", "label": "overlay", "kind": "async" }, { "from": "audithot", "to": "auditcold", "label": "tiered at 400 d", "kind": "batch" } ], "note": "A restore of every store on this page cannot revive one secret. That is a property of the digest scheme, not of access control.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "11-data-model", "title": "Data Model — what a credential actually is", "layout": "er", "canvas": { "width": 1660, "cols": 4 }, "rowGap": 240, "entities": [ { "id": "tenant", "name": "tenant", "kind": "store", "row": 0, "col": 0, "attrs": [ "tenant_id PK", "status", "revocation_epoch", "credential_quota", "leak_policy" ] }, { "id": "principal", "name": "principal", "kind": "store", "row": 0, "col": 1, "attrs": [ "principal_id PK", "tenant_id FK", "kind human | workload", "status", "held_scopes" ] }, { "id": "cred", "name": "credential", "kind": "store", "row": 0, "col": 2, "attrs": [ "kid PK", "tenant_id FK", "created_by FK", "prefix class + env", "digest HMAC(secret, pepper_v)", "pepper_version", "status", "expires_at", "label" ] }, { "id": "version", "name": "credential_version", "kind": "store", "row": 0, "col": 3, "attrs": [ "kid FK", "version PK", "scope_set", "constraints cidr | resource | env", "effective_from", "superseded_by" ] }, { "id": "audit", "name": "audit_record", "kind": "store", "row": 1, "col": 0, "attrs": [ "record_id PK", "prev_hash chain", "tenant_id FK", "kid FK nullable", "action", "actor", "before / after", "at" ] }, { "id": "usage", "name": "usage_observation", "kind": "store", "row": 1, "col": 1, "attrs": [ "kid FK", "window", "last_used_at ≤ 5 min lag", "call_count lossy", "last_region" ] }, { "id": "revocation", "name": "revocation", "kind": "store", "row": 1, "col": 2, "attrs": [ "seq PK monotonic", "kid FK (or tenant_id)", "reason", "actor", "accepted_at", "propagated_p99_ms" ] }, { "id": "scope", "name": "scope", "kind": "store", "row": 1, "col": 3, "attrs": [ "scope PK resource:action", "vocabulary_version", "grade read | write | admin", "deprecated_at" ] }, { "id": "leak", "name": "leak_incident", "kind": "store", "row": 2, "col": 2, "attrs": [ "incident_id PK", "kid FK", "source partner | internal", "confirmed_at", "action_taken", "trigger_trail" ] } ], "relations": [ { "from": "tenant", "to": "principal", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "principal", "to": "cred", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "cred", "to": "version", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "version", "to": "scope", "label": "N : M", "from_side": "s", "to_side": "n" }, { "from": "cred", "to": "revocation", "label": "1 : 0..1", "from_side": "s", "to_side": "n" }, { "from": "cred", "to": "usage", "label": "1 : N", "from_side": "s1", "to_side": "n" }, { "from": "tenant", "to": "audit", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "revocation", "to": "leak", "label": "0..1 : 1", "from_side": "s", "to_side": "n", "kind": "optional" } ], "note": "There is no secret column. The digest and its pepper version are the whole of what is stored, and the pepper is not here.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "12-verify-a-request", "title": "Critical Flow — verifying a credential on the request path", "layout": "sequence", "canvas": { "width": 1660 }, "lifelines": [ { "id": "client", "label": "Customer app", "kind": "external" }, { "id": "gw", "label": "API gateway", "kind": "integration" }, { "id": "sidecar", "label": "Verification sidecar", "kind": "app" }, { "id": "proj", "label": "Local projection", "kind": "store" }, { "id": "guard", "label": "Staleness guard", "kind": "decision" }, { "id": "svc", "label": "Product service", "kind": "app" }, { "id": "tel", "label": "Telemetry", "kind": "platform" } ], "messages": [ { "from": "client", "to": "gw", "label": "GET /v1/payments Authorization: sk_live_…", "kind": "call" }, { "from": "gw", "to": "sidecar", "label": "ext_authz over localhost", "kind": "call" }, { "from": "sidecar", "to": "sidecar", "label": "parse prefix, extract kid", "kind": "self" }, { "from": "sidecar", "to": "sidecar", "label": "HMAC(secret, cached pepper)", "kind": "self" }, { "from": "sidecar", "to": "proj", "label": "digest lookup", "kind": "call" }, { "from": "proj", "to": "sidecar", "label": "record or miss — constant cost", "kind": "return" }, { "from": "sidecar", "to": "proj", "label": "revocation overlay check", "kind": "call" }, { "from": "sidecar", "to": "guard", "label": "how stale is this projection?", "kind": "call" }, { "from": "guard", "to": "sidecar", "label": "fresh — 1.4 s behind the feed", "kind": "return" }, { "from": "sidecar", "to": "gw", "label": "VALID + context + staleness", "kind": "return" }, { "from": "gw", "to": "svc", "label": "forward with context header", "kind": "call" }, { "from": "sidecar", "to": "tel", "label": "sampled event, off the hot path", "kind": "async" }, { "from": "guard", "to": "gw", "label": "past 120 s: deny privileged scopes", "kind": "error" } ], "note": "Nothing on this page crosses a network boundary except the customer's own request. Budget: p99 ≤ 3 ms in-process.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "13-issue-and-rotate", "title": "Critical Flow — issuing a key, then rotating it without an outage", "layout": "sequence", "canvas": { "width": 1660 }, "lifelines": [ { "id": "dev", "label": "Developer", "kind": "actor" }, { "id": "console", "label": "Console / API", "kind": "app" }, { "id": "issue", "label": "Issuance service", "kind": "app" }, { "id": "kms", "label": "Cloud KMS", "kind": "security" }, { "id": "store", "label": "Credential store", "kind": "store" }, { "id": "rot", "label": "Rotation service", "kind": "app" }, { "id": "audit", "label": "Audit store", "kind": "store" } ], "messages": [ { "from": "dev", "to": "console", "label": "create key: scopes, label, expiry", "kind": "call" }, { "from": "console", "to": "issue", "label": "issue (tenant, principal, scopes)", "kind": "call" }, { "from": "issue", "to": "issue", "label": "reject scopes the principal lacks", "kind": "self" }, { "from": "issue", "to": "issue", "label": "160 bits from a CSPRNG", "kind": "self" }, { "from": "issue", "to": "kms", "label": "HMAC with pepper v7", "kind": "call" }, { "from": "kms", "to": "issue", "label": "digest", "kind": "return" }, { "from": "issue", "to": "store", "label": "write record — digest, never the secret", "kind": "call" }, { "from": "issue", "to": "audit", "label": "created: actor, scopes, expiry", "kind": "async" }, { "from": "issue", "to": "dev", "label": "the secret, once", "kind": "return" }, { "from": "dev", "to": "rot", "label": "rotate, 7-day overlap", "kind": "call" }, { "from": "rot", "to": "issue", "label": "issue successor, same scopes", "kind": "call" }, { "from": "rot", "to": "store", "label": "mark predecessor superseded", "kind": "call" }, { "from": "rot", "to": "dev", "label": "predecessor last used 4 days ago", "kind": "return" }, { "from": "rot", "to": "store", "label": "day 7: revoke predecessor", "kind": "async" } ], "note": "The secret exists in memory in exactly one process, for the length of one response. There is no path that returns it again.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "14-revocation-propagation", "title": "Revocation Propagation — accepted here, dead everywhere", "layout": "flow", "canvas": { "width": 1760 }, "chain": true, "align": "middle", "stages": [ { "title": "Accept", "nodes": [ { "id": "req", "label": "Revoke request", "kind": "integration", "sub": "console, API or policy" }, { "id": "durable", "label": "Durable append", "kind": "store", "sub": "multi-region quorum" }, { "id": "ack", "label": "Acknowledge", "kind": "decision", "sub": "only after quorum" } ] }, { "title": "Order", "nodes": [ { "id": "seq", "label": "Monotonic sequence", "kind": "store", "sub": "never rewound" }, { "id": "epoch", "label": "Tenant epoch bump", "kind": "store", "sub": "bulk in one write" } ] }, { "title": "Publish", "nodes": [ { "id": "push", "label": "Push channel", "kind": "queue", "sub": "Pub/Sub · p50 ≤ 2 s" }, { "id": "poll", "label": "Poll fallback", "kind": "integration", "sub": "5 s, self-healing" }, { "id": "hb", "label": "Heartbeat", "kind": "platform", "sub": "proves the feed lives" } ] }, { "title": "Apply", "nodes": [ { "id": "overlay", "label": "Overlay update", "kind": "store", "sub": "additive, idempotent" }, { "id": "ackback", "label": "Per-point ack", "kind": "app", "sub": "sequence high-water" } ] }, { "title": "Prove", "nodes": [ { "id": "canary", "label": "Revocation canary", "kind": "platform", "sub": "issue → revoke → re-verify" }, { "id": "slo", "label": "Propagation SLO", "kind": "decision", "sub": "p99 ≤ 10 s · ceiling 60 s" } ] }, { "title": "Fail safely", "nodes": [ { "id": "stale", "label": "Staleness ceiling", "kind": "risk", "sub": "120 s without a poll" }, { "id": "closed", "label": "Fail closed", "kind": "risk", "sub": "write and admin scopes refused" }, { "id": "ro", "label": "Read-only continues", "kind": "opportunity", "sub": "per tenant policy" } ] } ], "edges": [ { "from": "epoch", "to": "push", "label": "one message, N keys" }, { "from": "poll", "to": "overlay", "label": "catch-up", "kind": "async" }, { "from": "hb", "to": "stale", "label": "silence", "kind": "error" }, { "from": "stale", "to": "closed", "label": "past the ceiling", "kind": "error" } ], "note": "A revocation is acknowledged only after a durable multi-region write; everything downstream can be replayed, the acknowledgement cannot be taken back. Per-point acknowledgements feed the canary, which is how the p99 on this page is measured rather than asserted.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "15-leak-to-containment", "title": "Leak to Containment — who does what, in what order", "layout": "swimlane", "canvas": { "width": 1760 }, "laneHeaderWidth": 180, "stages": [ "Leak", "Detect", "Confirm", "Decide", "Contain", "Account" ], "lanes": [ { "title": "Outside world", "cells": [ [ { "label": "Key pushed to public repo", "kind": "risk" } ], [ { "label": "Scanner matches prefix", "kind": "external" } ], [ { "label": "Sends candidate string", "kind": "external" } ], [], [], [] ] }, { "title": "Platform — detection", "cells": [ [], [ { "label": "Own repo and log scanners", "kind": "app" } ], [ { "label": "Live-or-not endpoint", "kind": "integration", "sub": "rate-limited, one bit" } ], [ { "label": "Anomaly signal", "kind": "app", "sub": "new country, new scope" } ], [], [] ] }, { "title": "Platform — response", "cells": [ [], [], [ { "label": "Resolve kid → tenant", "kind": "app" } ], [ { "label": "Tenant policy", "kind": "decision", "sub": "revoke | downgrade | quarantine" } ], [ { "label": "Bulk revocation", "kind": "security" }, { "label": "Feed publish", "kind": "queue" } ], [ { "label": "Decision trail", "kind": "store", "sub": "what triggered it" } ] ] }, { "title": "Data plane", "cells": [ [ { "label": "Key verifies normally", "kind": "risk" } ], [], [], [], [ { "label": "Overlay updated", "kind": "store" }, { "label": "p99 ≤ 10 s", "kind": "opportunity" } ], [ { "label": "Denials counted per kid", "kind": "platform" } ] ] }, { "title": "Customer", "cells": [ [], [], [], [ { "label": "Webhook: leak_detected", "kind": "integration" } ], [ { "label": "Successor key issued", "kind": "app" } ], [ { "label": "Audit export to SIEM", "kind": "store" }, { "label": "Blast radius report", "kind": "opportunity" } ] ] } ], "note": "Auto-revocation on a confirmed partner match is the default. Auto-revocation on anomaly alone is opt-in, because a false positive here is an outage the customer did not cause.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" }, "cellWidth": 245 }, { "id": "16-deployment-architecture", "title": "Deployment — active-active verification, one control plane", "layout": "nested", "canvas": { "width": 1740 }, "boxes": [ { "title": "Google Cloud — three regions, one Spanner instance", "kind": "cloud", "dir": "row", "children": [ { "title": "europe-west1 — control-plane leader", "kind": "boundary", "nodes": [ { "id": "gke1", "label": "GKE — control plane", "kind": "app", "sub": "3 zones" }, { "id": "gke1d", "label": "GKE — product fleet", "kind": "app", "sub": "sidecars verify" }, { "id": "mem1", "label": "Memorystore", "kind": "store", "sub": "shared projection" }, { "id": "snap1", "label": "Snapshot bucket", "kind": "store", "sub": "regional" } ] }, { "title": "us-east4", "kind": "boundary", "nodes": [ { "id": "gke2", "label": "GKE — control plane", "kind": "app", "sub": "warm standby" }, { "id": "gke2d", "label": "GKE — product fleet", "kind": "app", "sub": "sidecars verify" }, { "id": "mem2", "label": "Memorystore", "kind": "store", "sub": "shared projection" }, { "id": "snap2", "label": "Snapshot bucket", "kind": "store", "sub": "regional" } ] }, { "title": "asia-southeast1", "kind": "boundary", "nodes": [ { "id": "gke3", "label": "GKE — control plane", "kind": "app", "sub": "warm standby" }, { "id": "gke3d", "label": "GKE — product fleet", "kind": "app", "sub": "sidecars verify" }, { "id": "mem3", "label": "Memorystore", "kind": "store", "sub": "shared projection" }, { "id": "snap3", "label": "Snapshot bucket", "kind": "store", "sub": "regional" } ] } ] }, { "title": "Multi-region, not per-region", "kind": "trust", "nodes": [ { "id": "spanner", "label": "Cloud Spanner", "kind": "store", "sub": "nam-eur-asia1 · RPO ≤ 5 s" }, { "id": "revlog", "label": "Revocation log", "kind": "store", "sub": "quorum write · RPO 0" }, { "id": "pubsub", "label": "Pub/Sub", "kind": "queue", "sub": "global topic" }, { "id": "kms", "label": "Cloud KMS / HSM", "kind": "security", "sub": "multi-region key ring" } ] } ], "edges": [ { "from": "gke1", "to": "spanner", "label": "writes" }, { "from": "revlog", "to": "pubsub", "label": "publish", "kind": "async" }, { "from": "pubsub", "to": "gke2d", "label": "overlay", "kind": "async" }, { "from": "pubsub", "to": "gke3d", "kind": "async" } ], "note": "Losing a region is a capacity event for verification (RTO 0) and a failover for the control plane (RTO ≤ 15 min). Each region's snapshot bucket warms a cold projection at start-up; those edges are omitted.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "17-config-and-release-pipeline", "title": "Release and Config — how a scope vocabulary reaches production", "layout": "flow", "canvas": { "width": 1760 }, "chain": true, "align": "middle", "stages": [ { "title": "Propose", "nodes": [ { "id": "pr", "label": "Scope or policy PR", "kind": "app", "sub": "declarative, versioned" }, { "id": "owner", "label": "Registry owner review", "kind": "actor", "sub": "one vocabulary, one owner" } ] }, { "title": "Check", "nodes": [ { "id": "lint", "label": "Vocabulary lint", "kind": "app", "sub": "no synonyms, no removals" }, { "id": "compat", "label": "Compatibility gate", "kind": "decision", "sub": "additive only" }, { "id": "sim", "label": "Replay simulation", "kind": "app", "sub": "yesterday's verifications" } ] }, { "title": "Build", "nodes": [ { "id": "artefact", "label": "Config artefact", "kind": "store", "sub": "immutable, signed" }, { "id": "sbom", "label": "Provenance", "kind": "security", "sub": "who built it, from what" } ] }, { "title": "Stage", "nodes": [ { "id": "canaryring", "label": "Canary ring", "kind": "app", "sub": "3 services, 30 min" }, { "id": "err", "label": "Error-rate watch", "kind": "decision", "sub": "auto-rollback" } ] }, { "title": "Roll out", "nodes": [ { "id": "ring1", "label": "Ring 1 — internal", "kind": "app", "sub": "20% of fleet" }, { "id": "ring2", "label": "Ring 2 — general", "kind": "app", "sub": "remainder" }, { "id": "refuse", "label": "Refuse unparseable", "kind": "risk", "sub": "keep last good" } ] }, { "title": "Prove", "nodes": [ { "id": "version", "label": "Config version per point", "kind": "platform", "sub": "spread is the alarm" }, { "id": "rollback", "label": "Last-good pin", "kind": "opportunity", "sub": "one command" } ] } ], "edges": [ { "from": "compat", "to": "refuse", "label": "removal rejected", "kind": "error" }, { "from": "err", "to": "rollback", "label": "regression", "kind": "error" } ], "note": "A verification point that cannot parse a config keeps the last good one and reports it. It never falls back to permitting everything.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "18-observability-and-canary", "title": "Observability — what is watched, and where it is watched from", "layout": "grid", "canvas": { "width": 1760 }, "laneHeaderWidth": 190, "columns": [ "Issuance", "Propagation", "Verification", "Containment", "Cost" ], "rows": [ { "title": "Golden signal", "cells": [ [ { "label": "Issuance p99", "kind": "platform", "sub": "≤ 400 ms" } ], [ { "label": "Propagation p99", "kind": "platform", "sub": "≤ 10 s" } ], [ { "label": "Verify p99", "kind": "platform", "sub": "≤ 3 ms" } ], [ { "label": "Leak-to-action p99", "kind": "platform", "sub": "≤ 60 s" } ], [ { "label": "Cost per verification", "kind": "platform" } ] ] }, { "title": "Correctness", "cells": [ [ { "label": "Escalation attempts blocked", "kind": "app" } ], [ { "label": "Feed sequence gaps", "kind": "risk" } ], [ { "label": "Staleness distribution", "kind": "app" } ], [ { "label": "Auto-actions reversed", "kind": "risk" } ], [ { "label": "Durable reads on hot path", "kind": "risk" } ] ] }, { "title": "Proof, not assertion", "cells": [ [ { "label": "Synthetic issue every 60 s", "kind": "platform" } ], [ { "label": "Revocation canary", "kind": "platform", "sub": "issue → revoke → re-verify" } ], [ { "label": "Known-bad key probe", "kind": "platform" } ], [ { "label": "Leak drill, monthly", "kind": "platform" } ], [ { "label": "Per-tenant cost report", "kind": "app" } ] ] }, { "title": "Silence detection", "cells": [ [ { "label": "No issuance in 15 min", "kind": "risk" } ], [ { "label": "Heartbeat missing", "kind": "risk", "sub": "the alarm that matters" } ], [ { "label": "Verification volume drop", "kind": "risk" } ], [ { "label": "Scanner feed quiet 24 h", "kind": "risk" } ], [] ] }, { "title": "Watched from", "cells": [ [ { "label": "In-region", "kind": "app" } ], [ { "label": "Separate project", "kind": "security" } ], [ { "label": "In-process counters", "kind": "app" } ], [ { "label": "Separate project", "kind": "security" } ], [ { "label": "Billing export", "kind": "store" } ] ] } ], "note": "The revocation canary is the one metric that would catch a silent propagation failure. It runs from a project this platform's operators cannot deploy to.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "19-credential-lifecycle", "title": "Credential Lifecycle — the loop every key travels", "layout": "cycle", "canvas": { "width": 1600 }, "centre": { "label": "Credential lifecycle" }, "nodes": [ { "id": "issued", "label": "Issued", "kind": "app", "sub": "scoped, dated, attributed" }, { "id": "inuse", "label": "In use", "kind": "app", "sub": "last_used_at observed" }, { "id": "warned", "label": "Expiry warned", "kind": "decision", "sub": "30 / 7 / 1 days" }, { "id": "rotating", "label": "Rotating", "kind": "app", "sub": "successor live, 7-day overlap" }, { "id": "revoked", "label": "Revoked", "kind": "security", "sub": "irreversible, propagated" }, { "id": "retained", "label": "Retained in audit", "kind": "store", "sub": "400 days hot, 7 years cold" } ], "ringLabels": [ "first call", "approaching expiry", "developer acts", "predecessor dies", "trail survives the key", "lessons set the next scope" ], "rx": 430, "ry": 215, "note": "A leak enters this ring at Revoked, from any state. The loop closes because the audit record outlives the credential.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "20-security-trust-zones", "title": "Trust Zones — what crosses each boundary, and what never does", "layout": "zones", "canvas": { "width": 1720 }, "zones": [ { "title": "Internet — untrusted", "kind": "trust", "nodes": [ { "id": "attacker", "label": "Holder of a leaked key", "kind": "risk" }, { "id": "capp", "label": "Customer application", "kind": "external" }, { "id": "scanner", "label": "Scanning partner", "kind": "external", "sub": "unauthenticated" }, { "id": "dev", "label": "Developer browser", "kind": "external" } ] }, { "title": "Perimeter", "kind": "trust", "nodes": [ { "id": "armor", "label": "Cloud Armor", "kind": "security", "sub": "prefix brute-force limits" }, { "id": "lb", "label": "Global load balancer", "kind": "integration" }, { "id": "partnerep", "label": "Partner endpoint", "kind": "integration", "sub": "one bit, hard quota" } ] }, { "title": "Product workloads", "kind": "trust", "nodes": [ { "id": "svc", "label": "Product services", "kind": "app" }, { "id": "sidecar", "label": "Verification sidecar", "kind": "app", "sub": "holds digests, not secrets" } ] }, { "title": "Credential control plane", "kind": "trust", "nodes": [ { "id": "issue", "label": "Issuance and rotation", "kind": "app", "sub": "mTLS only" }, { "id": "revoke", "label": "Revocation intake", "kind": "security" }, { "id": "console", "label": "Console backend", "kind": "app", "sub": "IAP + step-up" } ] }, { "title": "Credential state", "kind": "trust", "nodes": [ { "id": "spanner", "label": "Credential store", "kind": "store", "sub": "digests only" }, { "id": "audit", "label": "Audit store", "kind": "store", "sub": "append-only, chained" } ] }, { "title": "Key custody — separate blast radius", "kind": "trust", "nodes": [ { "id": "kms", "label": "Cloud KMS / HSM", "kind": "security", "sub": "pepper never leaves" } ] } ], "edges": [ { "from": "capp", "to": "lb", "label": "credential" }, { "from": "scanner", "to": "partnerep", "label": "candidate" }, { "from": "attacker", "to": "armor", "label": "throttled", "kind": "error" }, { "from": "lb", "to": "svc", "label": "request" }, { "from": "sidecar", "to": "issue", "label": "no call — by design", "kind": "error" }, { "from": "console", "to": "spanner", "label": "tenant-scoped query" }, { "from": "issue", "to": "kms", "label": "digest request" } ], "note": "Two crossings define the design: the sidecar never reaches the control plane, and the pepper never leaves KMS. A database exfiltration crosses neither.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "21-identity-and-access", "title": "Identity and Access — who proves what, before anything is issued", "layout": "sequence", "canvas": { "width": 1660 }, "lifelines": [ { "id": "human", "label": "Developer", "kind": "actor" }, { "id": "idp", "label": "Platform IdP", "kind": "security" }, { "id": "console", "label": "Console backend", "kind": "app" }, { "id": "issue", "label": "Issuance service", "kind": "app" }, { "id": "scope", "label": "Scope registry", "kind": "app" }, { "id": "store", "label": "Credential store", "kind": "store" }, { "id": "audit", "label": "Audit store", "kind": "store" } ], "messages": [ { "from": "human", "to": "idp", "label": "OIDC sign-in", "kind": "call" }, { "from": "idp", "to": "console", "label": "assertion: principal, tenant", "kind": "return" }, { "from": "human", "to": "console", "label": "create key with payments:write", "kind": "call" }, { "from": "console", "to": "idp", "label": "step-up: scope escalation", "kind": "call" }, { "from": "idp", "to": "console", "label": "re-authenticated", "kind": "return" }, { "from": "console", "to": "issue", "label": "issue (mTLS, workload identity)", "kind": "call" }, { "from": "issue", "to": "scope", "label": "does the principal hold payments:write?", "kind": "call" }, { "from": "scope", "to": "issue", "label": "yes — grade: write", "kind": "return" }, { "from": "issue", "to": "issue", "label": "refuse if the principal lacks it", "kind": "self" }, { "from": "issue", "to": "store", "label": "insert, tenant predicate enforced", "kind": "call" }, { "from": "issue", "to": "audit", "label": "actor, scopes, step-up evidence", "kind": "async" }, { "from": "issue", "to": "human", "label": "the secret, once", "kind": "return" } ], "note": "A principal can never issue a credential wider than itself. That single rule is what keeps key creation from being a privilege-escalation path.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "22-failure-modes", "title": "Failure Modes — what is assumed to break, and what happens then", "layout": "grid", "canvas": { "width": 1760 }, "laneHeaderWidth": 215, "columns": [ "What fails", "Blast radius", "Response", "Cost of the choice" ], "rows": [ { "title": "Control plane down", "cells": [ [ { "label": "Spanner or management API", "kind": "risk" } ], [ { "label": "No issuance or scope change", "kind": "app" } ], [ { "label": "Verification unaffected", "kind": "opportunity" } ], [ { "label": "Customers cannot rotate", "kind": "risk" } ] ] }, { "title": "Revocation channel down", "cells": [ [ { "label": "Pub/Sub or the poll path", "kind": "risk" } ], [ { "label": "Overlays stop advancing", "kind": "risk" } ], [ { "label": "Fail closed at 120 s", "kind": "security" } ], [ { "label": "Writes refused platform-wide", "kind": "risk" } ] ] }, { "title": "Region partitioned", "cells": [ [ { "label": "One region loses the feed", "kind": "risk" } ], [ { "label": "That region only", "kind": "app" } ], [ { "label": "Staleness on every response", "kind": "app" } ], [ { "label": "Read-only degradation", "kind": "opportunity" } ] ] }, { "title": "KMS unreachable", "cells": [ [ { "label": "Pepper fetch fails", "kind": "risk" } ], [ { "label": "Issuance halts", "kind": "app" } ], [ { "label": "Verify on cached version", "kind": "opportunity" } ], [ { "label": "Pepper rotation blocked", "kind": "risk" } ] ] }, { "title": "Poison config", "cells": [ [ { "label": "Bad vocabulary or policy", "kind": "risk" } ], [ { "label": "Every point, at once", "kind": "risk" } ], [ { "label": "Refuse, keep last good", "kind": "security" } ], [ { "label": "Config spread to reconcile", "kind": "app" } ] ] }, { "title": "Store exfiltrated", "cells": [ [ { "label": "Full database copy taken", "kind": "risk" } ], [ { "label": "Digests, no usable secrets", "kind": "opportunity" } ], [ { "label": "Rotate the pepper", "kind": "security" } ], [ { "label": "Dual-version verify window", "kind": "app" } ] ] }, { "title": "Cold restart storm", "cells": [ [ { "label": "Fleet restarts together", "kind": "risk" } ], [ { "label": "Empty projections", "kind": "risk" } ], [ { "label": "Snapshot warm-up, gated admission", "kind": "security" } ], [ { "label": "Slower rollouts", "kind": "app" } ] ] }, { "title": "False leak positive", "cells": [ [ { "label": "Anomaly misfires", "kind": "risk" } ], [ { "label": "A live customer integration", "kind": "risk" } ], [ { "label": "Opt-in only, reversible, attributed", "kind": "security" } ], [ { "label": "Slower containment by default", "kind": "risk" } ] ] } ], "note": "Every row trades availability for revocation correctness, in that direction. The fourth column is the price, stated rather than hidden.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } } ]