Audit Log Service  ·  View 35 of 40  ·  7 · Assurance

Trust Zones

Six zones of decreasing exposure, every crossing authenticated — and the one edge that deliberately is not.

Editable source SVG draw.io All views
Internet — assumed hostile Off-Estate Producer partner systems Auditor Workstation offline verification Published Key + Algorithm deliberately public Perimeter — holds no key Front Door + WAF rate limit, TLS 1.3 Private Endpoint in-estate default path Envoy mTLS SVID or Entra token Capture — write only Ingest API ingest-mi Validator + Detector reject or accept Kafka Buffer no delete API exposed Custody — no standing access Sealer + Chain custody-mi Segment Store create-only role Retention Engine extend only Evidence and query Query API query-mi, tenant scoped Verifier read-only on segments Export Service capped, watermarked Key and checkpoint custody Managed HSM non-exportable Confidential Ledger append only Custody Admin Group disjoint membership TLS 1.3 + workload token principal, tenant, write scope consume, in-cluster mTLS read-only SAS-free RBAC sign · Crypto User only signed bundle, out of band Trust Zones — Every Crossing Authenticated, Every Zone Narrower External / third party Security / platform Interface / broker Application we own Queue / topic Data store synchronous event / async Zones narrow left to right and every crossing is mutually authenticated, in-cluster included. The perimeter can see a record in flight and can read none at rest; the custody zone has no standing human access at all; and the last edge leaves unauthenticated on purpose, because the bundle is built to be verified by someone holding no credential of ours. v 1.0 · owner Data & AI Global Practice · date 2026-09

Decisions

  • Encryption in transit is mutually authenticated at every crossing, including inside the cluster. The only unauthenticated edge is the last one, because the evidence bundle is designed to be verified by someone holding no credential of ours.
  • The custody zone has no standing human access at all. Access is PIM-gated, time-boxed, quorum-approved and itself an audit event.
  • The perimeter holds no decryption key. Anything that terminates TLS can see a record in flight and cannot read one at rest.

Where an attacker arrives

  • Most realistically: a compromised producer credential, which can write into one tenant and read nothing. The blast radius is polluted records in one tenant, detectable by rate and shape.
  • Most damagingly: a compromised investigator or compliance session, which can read and export. This is why export is capped, watermarked and anomaly-alerted.
  • Most interestingly: an insider with custody-plane access, which view 39 works through row by row.

Assumptions

  • Encryption at rest uses per-tenant customer-managed keys in Managed HSM, with key use audited into this service. Customer-held keys are phase 3.
◀  The Operator's Loop All views Identity and Credentials  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 40 views · Microsoft Azure and open source35-security-trust-zones