[ { "id": "01-system-context", "title": "Certificate Lifecycle Service — System Context", "layout": "context", "system": { "label": "Certificate Lifecycle Service", "sub": "issue · renew · verify · revoke" }, "colWidth": 260, "groups": [ { "side": "left", "title": "People", "nodes": [ { "id": "tenant", "label": "Tenant admin", "kind": "actor", "rel": "adds a domain", "dir": "in" }, { "id": "sre", "label": "Platform SRE", "kind": "actor", "rel": "expiry board", "dir": "in" }, { "id": "secops", "label": "Security engineer", "kind": "actor", "rel": "sets policy", "dir": "in" } ] }, { "side": "right", "title": "Trust authorities and custody", "nodes": [ { "id": "acmeca", "label": "Public CA", "sub": "ACME, 2 accounts", "kind": "external", "rel": "ACME orders" }, { "id": "ct", "label": "CT logs", "sub": "SCTs, monitoring", "kind": "external", "rel": "SCTs" }, { "id": "pca", "label": "AWS Private CA", "sub": "root + 2 intermediates", "kind": "security", "rel": "signs leaves" } ] }, { "side": "top", "title": "What consumes certificates", "nodes": [ { "id": "edge", "label": "Edge and load balancers", "sub": "CloudFront · ALB", "kind": "app", "rel": "public TLS" }, { "id": "mesh", "label": "Workloads and mesh", "sub": "EKS, 3,800 workloads", "kind": "app", "rel": "mTLS + bundles" } ] }, { "side": "bottom", "title": "Adjacent systems — not owned here", "nodes": [ { "id": "custdns", "label": "Customer DNS", "sub": "registrar of record", "kind": "external", "rel": "delegation", "kind2": "sync" }, { "id": "secrets", "label": "Secrets platform", "kind": "external", "rel": "delivery" }, { "id": "cicd", "label": "Deployment pipeline", "kind": "external", "rel": "readiness", "kind2": "async" }, { "id": "siem", "label": "Audit and SIEM", "kind": "external", "rel": "events", "kind2": "async" } ] } ], "note": "The relying parties that hold trust bundles are the same edge and workload populations shown above. Out of scope: TLS termination itself, the secrets platform, code signing, and tenant-uploaded certificates (Phase 3).", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "02-high-level-architecture", "title": "Certificate Lifecycle Service — High-Level Architecture", "layout": "flow", "chain": true, "align": "middle", "stages": [ { "title": "Request and policy", "nodes": [ { "id": "s1a", "label": "Order manager", "sub": "API + queue", "kind": "app" }, { "id": "s1b", "label": "Policy engine", "sub": "who may ask for what", "kind": "security" } ] }, { "title": "Prove entitlement", "nodes": [ { "id": "s2a", "label": "Domain control", "sub": "DNS-01 · HTTP-01", "kind": "app" }, { "id": "s2b", "label": "Workload attestation", "sub": "IRSA · instance identity", "kind": "security" } ] }, { "title": "Issue", "nodes": [ { "id": "s3a", "label": "Public issuance", "sub": "ACME to public CA", "kind": "integration" }, { "id": "s3b", "label": "Private issuance", "sub": "AWS Private CA", "kind": "security" } ] }, { "title": "Distribute and install", "nodes": [ { "id": "s4a", "label": "Delivery adapters", "sub": "SDS · agent · ACM", "kind": "integration" }, { "id": "s4b", "label": "Trust bundles", "sub": "signed, versioned", "kind": "security" } ] }, { "title": "Verify serving", "nodes": [ { "id": "s5a", "label": "Endpoint prober", "sub": "reads the handshake", "kind": "app" }, { "id": "s5b", "label": "Discovery", "sub": "scan · CT monitor", "kind": "app", "icon": "fa5_search" } ] }, { "title": "Renew or revoke", "nodes": [ { "id": "s6a", "label": "Renewal scheduler", "sub": "at 1/3 life left", "kind": "app" }, { "id": "s6b", "label": "Revocation", "sub": "CRL · OCSP", "kind": "integration" } ] } ], "edges": [ { "from": "s6a", "to": "s1a", "kind": "async", "route": "gutter" } ], "note": "The loop closes at 'verify serving', not at 'issue'. An issued certificate nothing is observed presenting is not a renewal that happened.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "03-actors-and-journeys", "title": "Certificate Lifecycle Service — Actors and Their Core Journeys", "layout": "actors", "groups": [ { "title": "Customers", "kind": "boundary", "actors": [ { "id": "tenantadmin", "label": "Tenant admin", "sub": "9,000 tenants", "goal": "Put my own brand on the product and never think about the padlock again.", "journeys": [ { "id": "j-domain", "label": "Bring a custom domain", "sub": "24,000 live" }, { "id": "j-status", "label": "Check my domain's status" } ] }, { "id": "custsec", "label": "Customer security reviewer", "sub": "at renewal and audit", "goal": "Prove to my auditor that nobody but this vendor can issue for my domain.", "journeys": [ { "label": "Read the CT record for my domain" }, { "label": "Revoke the delegation on exit" } ] } ] }, { "title": "The people who run it", "kind": "onprem", "actors": [ { "id": "sreact", "label": "Platform SRE", "sub": "1 primary, 1 secondary", "goal": "Never be the person who let a certificate expire in production.", "journeys": [ { "id": "j-expiry", "label": "Clear a failing renewal", "sub": "before it matters" }, { "label": "Answer: what is closest to expiry?" } ] }, { "id": "secengact", "label": "Security engineer", "sub": "PKI owner", "goal": "Be able to revoke and replace the whole estate inside a deadline someone else set.", "journeys": [ { "label": "Run a root ceremony" }, { "label": "Rotate an issuing intermediate" }, { "label": "Rehearse bulk re-issuance" } ] }, { "id": "svcowneract", "label": "Service owner", "sub": "~300 teams", "goal": "Get an identity my service can use without ever handling a private key.", "journeys": [ { "label": "Onboard a service to mTLS" }, { "label": "Find out why my handshake failed" } ] } ] }, { "title": "Machines and partners", "kind": "cloud", "actors": [ { "id": "workloadact", "label": "Workload", "kind": "app", "sub": "3,800, 24 h leaves", "goal": "Hold a valid identity at all times without anyone noticing it changed.", "journeys": [ { "id": "j-workload", "label": "Renew its own identity", "sub": "46,000 / day" } ], "icon": "kubernetes" }, { "id": "publicca", "label": "Public CA", "kind": "external", "sub": "2 accounts, ACME", "goal": "Receive well-formed orders inside my rate limits and validate them once.", "journeys": [ { "label": "Answer an ACME order" }, { "label": "Mandate a bulk revocation" } ] }, { "id": "prober", "label": "Endpoint prober", "kind": "platform", "sub": "every 15 min", "goal": "Tell the registry what is actually being served, whoever issued it.", "journeys": [ { "label": "Sweep every known endpoint" }, { "label": "Report a certificate nobody registered" } ] } ] } ], "note": "The workload and the prober are actors, not components: each has a goal the architecture must serve, and the prober's goal is the one the whole design rests on.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "04-journey-bring-a-domain", "title": "User Journey — A Tenant Brings Their Own Domain", "layout": "journey", "actor": { "label": "Tenant admin", "sub": "one of 9,000; not a PKI expert", "goal": "Serve the product on support.acme-corp.com with a padlock and no ticket", "trigger": "Marketing wants the product on the company's own domain before launch", "success": "The domain serves, and it keeps serving for years without them returning" }, "phases": [ { "title": "Add domain", "sub": "console" }, { "title": "Delegate DNS", "moment": true }, { "title": "Wait", "sub": "minutes" }, { "title": "Cut over", "moment": true }, { "title": "Forget it", "sub": "years" } ], "lanes": [ { "title": "What they do", "kind": "step", "cells": [ [ { "label": "Types the hostname" } ], [ { "label": "Copies one CNAME" }, { "label": "Pastes it at the registrar" } ], [ { "label": "Refreshes the page" } ], [ { "label": "Repoints the A record" } ], [ { "label": "Nothing" } ] ] }, { "title": "Where", "kind": "touch", "cells": [ [ { "label": "Tenant console" } ], [ { "label": "Their DNS provider", "sub": "not ours" } ], [ { "label": "Domain status page" } ], [ { "label": "Their DNS provider" } ], [ { "label": "Renewal email", "sub": "only if it fails" } ] ] }, { "title": "How it feels", "kind": "emotion", "levels": [ "Delighted", "Fine", "Frustrated" ], "points": [ 1, 0, 1, 2, 2 ] }, { "title": "Behind the glass", "kind": "system", "cells": [ [ { "label": "Domain register" }, { "label": "Name denylist" } ], [ { "label": "Delegation checker" } ], [ { "label": "ACME order" }, { "label": "DNS-01 responder" } ], [ { "label": "ACM import" }, { "label": "Edge binding" } ], [ { "label": "Renewal scheduler" }, { "label": "Endpoint prober" } ] ] }, { "title": "Where it hurts", "kind": "pain", "cells": [ [], [ { "label": "Registrar UI is theirs" }, { "label": "Propagation is opaque" } ], [ { "label": "\"Pending\" with no reason" } ], [ { "label": "HTTP-01 cannot pre-issue" } ], [ { "label": "Silent delegation removal" } ] ] }, { "title": "What answers it", "kind": "gain", "cells": [ [ { "label": "One hostname field" } ], [ { "label": "One permanent CNAME" } ], [ { "label": "Named failure reasons" } ], [ { "label": "Issue before cutover" } ], [ { "label": "Delegation health check" } ] ] } ], "note": "CNAME delegation is a one-time act by design: every later renewal is answered inside the platform's own zone, so the trough at phase 2 is paid once rather than every 90 days.", "meta": { "v": "1.0", "owner": "Experience and Platform", "date": "2026-09" } }, { "id": "05-journey-expiry-that-didnt-happen", "title": "User Journey — The Expiry That Did Not Happen", "layout": "journey", "actor": { "label": "Platform SRE", "sub": "on call for the estate", "goal": "Find out about a broken renewal while it is still boring", "trigger": "A renewal attempt fails 30 days before expiry and nothing breaks yet", "success": "The new serial is observed serving, and nobody outside the team ever knew" }, "phases": [ { "title": "Renewal due", "sub": "T-30 d" }, { "title": "It fails", "sub": "silently" }, { "title": "They find out", "moment": true }, { "title": "They fix it", "sub": "in hours" }, { "title": "Verified", "moment": true } ], "lanes": [ { "title": "What they do", "kind": "step", "cells": [ [ { "label": "Nothing" } ], [ { "label": "Nothing" } ], [ { "label": "Reads the named reason" } ], [ { "label": "Fixes the delegation" }, { "label": "Re-runs the order" } ], [ { "label": "Closes the alert" } ] ] }, { "title": "Where", "kind": "touch", "cells": [ [], [], [ { "label": "Expiry dashboard" }, { "label": "Ticket at T-30" } ], [ { "label": "Order detail page" } ], [ { "label": "Probe result" } ] ] }, { "title": "How it feels", "kind": "emotion", "levels": [ "Calm", "Alert", "Alarmed" ], "points": [ 2, 2, 0, 1, 2 ] }, { "title": "Behind the glass", "kind": "system", "cells": [ [ { "label": "Renewal scheduler" } ], [ { "label": "Jittered retry" }, { "label": "Attempt ledger" } ], [ { "label": "Escalation ladder" }, { "label": "Owner lookup" } ], [ { "label": "Order manager" }, { "label": "Delivery adapter" } ], [ { "label": "Endpoint prober" }, { "label": "Divergence check" } ] ] }, { "title": "Where it hurts", "kind": "pain", "cells": [ [], [ { "label": "A failed job is not an alert" } ], [ { "label": "No owner on the record" } ], [ { "label": "Issued but not reloaded" } ], [ { "label": "Probe cannot reach it" } ] ] }, { "title": "What answers it", "kind": "gain", "cells": [ [ { "label": "Renew at 1/3 life" } ], [ { "label": "Incident at first failure" } ], [ { "label": "Owner required to manage" } ], [ { "label": "Reload is part of renewal" } ], [ { "label": "Unprobeable is a gap" } ] ] } ], "note": "The trough is at 'they find out', which is the only phase the architecture can move. Every design choice in this set exists to make it arrive at T-30 rather than at T-0.", "meta": { "v": "1.0", "owner": "Reliability Architecture", "date": "2026-09" } }, { "id": "06-layered-architecture", "title": "Certificate Lifecycle Service — Layered Architecture", "layout": "bands", "layerHeaderWidth": 165, "bands": [ { "name": "Policy and definition", "nodes": [ { "id": "b1a", "label": "CA hierarchy", "sub": "roots · intermediates", "kind": "security" }, { "id": "b1b", "label": "Issuance profiles", "sub": "EKU · constraints", "kind": "security" }, { "id": "b1c", "label": "Renewal policy", "sub": "1/3 of life", "kind": "security" }, { "id": "b1d", "label": "Revocation posture", "sub": "per relying party", "kind": "security" } ] }, { "name": "Control plane", "nodes": [ { "id": "b2a", "label": "Order manager", "kind": "app" }, { "id": "b2b", "label": "Renewal scheduler", "kind": "app" }, { "id": "b2c", "label": "Validation orchestrator", "kind": "app" }, { "id": "b2d", "label": "Policy engine", "kind": "security" }, { "id": "b2e", "label": "Escalation ladder", "kind": "app" } ] }, { "name": "Issuance plane", "nodes": [ { "id": "b3a", "label": "ACME client", "sub": "public path", "kind": "integration" }, { "id": "b3b", "label": "DNS-01 responder", "kind": "integration" }, { "id": "b3c", "label": "Attestation verifier", "sub": "private path", "kind": "security" }, { "id": "b3d", "label": "Issuing intermediates", "sub": "A and B, both live", "kind": "security" } ] }, { "name": "Key custody", "nodes": [ { "id": "b4a", "label": "Offline root", "sub": "ceremony only", "kind": "security" }, { "id": "b4b", "label": "Signing modules", "sub": "FIPS 140-2 L3", "kind": "security" }, { "id": "b4c", "label": "Ceremony records", "kind": "store" } ] }, { "name": "Distribution", "nodes": [ { "id": "b5a", "label": "Mesh SDS", "kind": "integration" }, { "id": "b5b", "label": "Node agent", "kind": "integration" }, { "id": "b5c", "label": "Edge binding", "sub": "ACM · ALB · CloudFront", "kind": "integration" }, { "id": "b5d", "label": "Reload trigger", "kind": "app" } ] }, { "name": "Trust plane", "nodes": [ { "id": "b6a", "label": "Bundle builder", "sub": "signed, versioned", "kind": "security" }, { "id": "b6b", "label": "Bundle distribution", "kind": "integration" }, { "id": "b6c", "label": "Version reporting", "sub": "per relying party", "kind": "app" }, { "id": "b6d", "label": "Rotation gate", "kind": "decision" } ] }, { "name": "Verification", "nodes": [ { "id": "b7a", "label": "Endpoint prober", "kind": "app" }, { "id": "b7b", "label": "Network and DNS scan", "kind": "app" }, { "id": "b7c", "label": "CT monitor", "kind": "app" }, { "id": "b7d", "label": "Divergence detector", "kind": "app" } ] }, { "name": "Registry and evidence", "nodes": [ { "id": "b8a", "label": "Certificate registry", "kind": "store" }, { "id": "b8b", "label": "Issuance ledger", "sub": "append-only", "kind": "store" }, { "id": "b8c", "label": "CRL and OCSP", "kind": "integration" }, { "id": "b8d", "label": "Expiry dashboard", "kind": "platform" } ] } ], "edges": [ { "from": "b1a", "to": "b2a", "label": "reconciled", "kind": "sync" }, { "from": "b2c", "to": "b3a", "kind": "sync" }, { "from": "b3d", "to": "b4b", "label": "sign", "kind": "sync" }, { "from": "b3d", "to": "b5a", "kind": "sync" }, { "from": "b6d", "to": "b3d", "label": "gates issuance", "kind": "error", "route": "gutter" }, { "from": "b7d", "to": "b8a", "label": "observed state", "kind": "sync" }, { "from": "b8a", "to": "b2b", "label": "what is due", "kind": "sync", "route": "gutter" } ], "note": "The trust plane sits above verification deliberately: a new authority is distributed and confirmed before the issuance plane is allowed to sign beneath it.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "07-platform-components", "title": "Certificate Lifecycle Service — Container View", "layout": "nested", "canvas": { "width": 1720 }, "boxes": [ { "title": "AWS — PKI platform account (eu-west-1, primary)", "kind": "cloud", "dir": "col", "children": [ { "title": "Control plane — EKS, no signing authority of its own", "kind": "boundary", "nodes": [ { "id": "c1", "label": "Order manager", "sub": "Go, HTTP + SQS", "kind": "app" }, { "id": "c2", "label": "Renewal scheduler", "sub": "EventBridge rules", "kind": "app" }, { "id": "c3", "label": "Validation orchestrator", "sub": "Lambda fan-out", "kind": "app" }, { "id": "c4", "label": "Policy engine", "sub": "OPA bundles", "kind": "security" } ] }, { "title": "Issuance plane — the only components that can cause a signature", "kind": "trust", "nodes": [ { "id": "c5", "label": "ACME client", "sub": "2 CA accounts", "kind": "integration" }, { "id": "c6", "label": "DNS-01 responder", "sub": "Route 53 zone", "kind": "integration" }, { "id": "c7", "label": "Attestation verifier", "sub": "IRSA · IMDSv2", "kind": "security" }, { "id": "c8", "label": "AWS Private CA", "sub": "2 issuing CAs", "kind": "security" } ] }, { "title": "Verification plane — independent of issuance by design", "kind": "boundary", "nodes": [ { "id": "c9", "label": "Endpoint prober", "sub": "Lambda, 15 min", "kind": "app" }, { "id": "c10", "label": "Discovery scanner", "sub": "network + DNS", "kind": "app", "icon": "fa5_search" }, { "id": "c11", "label": "CT monitor", "sub": "all managed domains", "kind": "app" }, { "id": "c12", "label": "Divergence detector", "kind": "app" } ] }, { "title": "State", "kind": "boundary", "nodes": [ { "id": "c13", "label": "Certificate registry", "sub": "DynamoDB", "kind": "store" }, { "id": "c14", "label": "Issuance ledger", "sub": "S3 Object Lock", "kind": "store" }, { "id": "c15", "label": "Observed index", "sub": "DynamoDB TTL", "kind": "store" }, { "id": "c16", "label": "Lifecycle bus", "sub": "EventBridge", "kind": "queue" } ] } ] } ], "outside": [ { "id": "o5", "label": "Workload clusters", "sub": "6 EKS, 3 regions", "kind": "app" }, { "id": "o1", "label": "Public CA", "sub": "ACME", "kind": "external" }, { "id": "o2", "label": "CT logs", "kind": "external" }, { "id": "o3", "label": "CloudHSM", "sub": "root custody", "kind": "security" }, { "id": "o4", "label": "Customer DNS", "kind": "external" }, { "id": "o6", "label": "Edge and ACM", "kind": "app" } ], "edges": [ { "from": "c9", "to": "o5", "label": "handshake", "kind": "sync" }, { "from": "c8", "to": "o3", "label": "signing", "kind": "sync" } ], "note": "Only the two edges that carry the design are drawn: the prober reaching a live endpoint, and the one path to a signing key. The ACME calls to the public CA and CT logs, the DNS-01 delegation from customer DNS, and the secondary regions are in views 08, 12 and 16.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "08-integration-surface", "title": "Certificate Lifecycle Service — Integration Architecture", "layout": "hub", "left": { "title": "Who asks", "nodes": [ { "id": "i1", "label": "Tenant console", "sub": "domain onboarding", "kind": "app", "rel": "REST" }, { "id": "i2", "label": "Workload agent and mesh SDS", "sub": "cert-manager", "kind": "app", "rel": "CSR" }, { "id": "i4", "label": "Deployment pipeline", "kind": "external", "rel": "readiness" } ] }, "centre": { "title": "Certificate Lifecycle Service", "nodes": [ { "id": "hub", "label": "Certificate Lifecycle Service", "sub": "one registry, two trust domains", "kind": "app" } ] }, "right": { "title": "What it depends on", "nodes": [ { "id": "d1", "label": "Public CA", "sub": "2 accounts, ACME", "kind": "external", "rel": "orders · SCT", "dir": "out" }, { "id": "d3", "label": "CT logs", "kind": "external", "rel": "SCT + watch", "dir": "out" }, { "id": "d4", "label": "AWS Private CA", "kind": "security", "rel": "sign", "dir": "out" } ] }, "note": "Route 53 is not a dependency here but a platform-owned component — the delegated zone the DNS-01 responder answers in (view 07). Two public CA accounts sit behind one integration, so failover is a configuration change rather than a new surface. The only synchronous obligation on a request path is workload issuance; everything else may queue.", "meta": { "v": "1.0", "owner": "Integration Architecture", "date": "2026-09" } }, { "id": "09-data-flow", "title": "Certificate Lifecycle Service — Data Flow", "layout": "flow", "chain": true, "align": "top", "stages": [ { "title": "Declared", "nodes": [ { "id": "f1a", "label": "Policy repository", "sub": "git, reviewed", "kind": "store" }, { "id": "f1b", "label": "Domain register", "sub": "per tenant", "kind": "store" }, { "id": "f1c", "label": "Owner directory", "sub": "team per identity", "kind": "store" } ] }, { "title": "Requested", "nodes": [ { "id": "f2a", "label": "Order record", "sub": "subject · profile", "kind": "store" }, { "id": "f2b", "label": "Validation evidence", "sub": "how control was proved", "kind": "store" } ] }, { "title": "Issued", "nodes": [ { "id": "f3a", "label": "Issuance ledger", "sub": "append-only, 10 y", "kind": "store" }, { "id": "f3b", "label": "Certificate record", "sub": "issuer + serial", "kind": "store" }, { "id": "f3c", "label": "CT entry", "sub": "public certs only", "kind": "external" } ] }, { "title": "Distributed", "nodes": [ { "id": "f4a", "label": "Delivery receipt", "sub": "where it was written", "kind": "store" }, { "id": "f4b", "label": "Bundle version report", "sub": "per relying party", "kind": "store" } ] }, { "title": "Observed", "nodes": [ { "id": "f5a", "label": "Probe observation", "sub": "serial seen serving", "kind": "store" }, { "id": "f5b", "label": "Discovery finding", "sub": "scan · CT watch", "kind": "store" }, { "id": "f5c", "label": "Divergence", "sub": "registry vs reality", "kind": "risk" } ] }, { "title": "Reported", "nodes": [ { "id": "f6a", "label": "Expiry projection", "sub": "shortest life first", "kind": "platform" }, { "id": "f6b", "label": "Revocation list", "sub": "CRL · OCSP", "kind": "integration" }, { "id": "f6c", "label": "Evidence export", "sub": "audit · SIEM", "kind": "platform" } ] } ], "edges": [ { "from": "f5a", "to": "f3b", "label": "sets lifecycle state", "kind": "sync", "route": "gutter" } ], "note": "The only write that moves a certificate into SERVING comes from the observation stage. Every other stage records intent; this one records fact.", "meta": { "v": "1.0", "owner": "Data Architecture", "date": "2026-09" } }, { "id": "10-data-ownership-zones", "title": "Certificate Lifecycle Service — Data Architecture and Ownership", "layout": "nested", "canvas": { "width": 1700 }, "boxes": [ { "title": "Four zones, four different rules about who may write and what may be rebuilt", "kind": "plain", "dir": "col", "children": [ { "title": "Declared — human-authored, reviewed, versioned. The control plane reconciles it and never edits it.", "kind": "boundary", "nodes": [ { "id": "z1", "label": "CA hierarchy", "sub": "git, two-person review", "kind": "store" }, { "id": "z2", "label": "Issuance profiles", "sub": "git", "kind": "store" }, { "id": "z3", "label": "Renewal and revocation policy", "sub": "git", "kind": "store" }, { "id": "z4", "label": "Owner directory", "sub": "sourced from the org", "kind": "store" } ] }, { "title": "Immutable evidence — append-only, retention-bound, no operator can edit or delete", "kind": "trust", "nodes": [ { "id": "z5", "label": "Issuance ledger", "sub": "S3 Object Lock, 10 y", "kind": "store" }, { "id": "z6", "label": "Ceremony records", "sub": "witnessed, 10 y", "kind": "store" }, { "id": "z7", "label": "Validation evidence", "sub": "3 y", "kind": "store" }, { "id": "z8", "label": "Revocation records", "sub": "CA life + 1 y", "kind": "store" } ] }, { "title": "Derived — rebuildable from the ledger plus one full probe sweep, and that rebuild is rehearsed annually", "kind": "boundary", "nodes": [ { "id": "z9", "label": "Certificate registry", "sub": "DynamoDB, ~70 k live", "kind": "store" }, { "id": "z10", "label": "Observed index", "sub": "90 d full, 2 y aggregate", "kind": "store" }, { "id": "z11", "label": "Expiry projections", "sub": "recomputed each sweep", "kind": "store" }, { "id": "z12", "label": "Unmanaged findings", "sub": "owner + deadline", "kind": "risk" } ] }, { "title": "Tenant-isolated — customer data, partitioned per tenant, deleted on exit", "kind": "trust", "nodes": [ { "id": "z13", "label": "Domain register", "sub": "24,000 domains", "kind": "store" }, { "id": "z14", "label": "Delegation state", "sub": "proven_at, re-prove due", "kind": "store" }, { "id": "z15", "label": "Challenge tokens", "sub": "ephemeral, never logged", "kind": "store" } ] } ] } ], "outside": [ { "id": "z16", "label": "Private keys", "sub": "generated in the workload, never stored here", "kind": "risk" } ], "note": "The zone that is not drawn as a store is the point: no private key material exists anywhere in this platform, which is a consequence of CSR-only issuance rather than an access control.", "meta": { "v": "1.0", "owner": "Data Architecture", "date": "2026-09" } }, { "id": "11-data-model", "title": "Certificate Lifecycle Service — Core Data Model", "layout": "er", "canvas": { "width": 1660, "cols": 4 }, "rowGap": 260, "entities": [ { "id": "tenant", "name": "tenant", "kind": "store", "row": 0, "col": 0, "attrs": [ "tenant_id PK", "name", "status" ] }, { "id": "domain", "name": "domain_ownership", "kind": "store", "row": 0, "col": 1, "attrs": [ "domain PK", "tenant_id FK", "method dns-01 | http-01", "proven_at", "reprove_due" ] }, { "id": "profile", "name": "issuance_profile", "kind": "store", "row": 0, "col": 2, "attrs": [ "profile_id PK", "key_alg", "max_lifetime", "eku", "name_constraints" ] }, { "id": "identity", "name": "managed_identity", "kind": "store", "row": 0, "col": 3, "attrs": [ "identity_id PK", "trust_domain", "subject / SAN", "owner_team", "class" ] }, { "id": "authority", "name": "ca_authority", "kind": "store", "row": 1, "col": 0, "attrs": [ "authority_id PK", "tier root | issuing", "not_after", "hsm_ref", "status" ] }, { "id": "cert", "name": "certificate", "kind": "store", "row": 1, "col": 1, "attrs": [ "issuer + serial PK", "identity_id FK", "authority_id FK", "profile_id FK", "not_before / not_after", "state" ] }, { "id": "endpoint", "name": "endpoint", "kind": "store", "row": 1, "col": 3, "attrs": [ "endpoint_id PK", "identity_id FK", "address", "probeable bool" ] }, { "id": "bundle", "name": "trust_bundle", "kind": "store", "row": 1, "col": 2, "attrs": [ "bundle_id PK", "version", "authority_ids", "signed_at" ] }, { "id": "revocation", "name": "revocation", "kind": "store", "row": 2, "col": 0, "attrs": [ "issuer + serial PK/FK", "reason_code", "actor", "revoked_at", "published_at" ] }, { "id": "issuance", "name": "issuance_event", "kind": "store", "row": 2, "col": 1, "attrs": [ "event_id PK", "issuer + serial FK", "requested_by", "policy_ref", "occurred_at" ] }, { "id": "report", "name": "bundle_report", "kind": "store", "row": 2, "col": 2, "attrs": [ "report_id PK", "bundle_id FK", "relying_party", "reported_at" ] }, { "id": "obs", "name": "observation", "kind": "store", "row": 2, "col": 3, "attrs": [ "observation_id PK", "endpoint_id FK", "observed_serial FK", "chain_ok", "observed_at" ] } ], "relations": [ { "from": "tenant", "to": "domain", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "domain", "to": "cert", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "profile", "to": "cert", "label": "1 : N", "from_side": "s1", "to_side": "n3" }, { "from": "authority", "to": "cert", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "identity", "to": "endpoint", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "cert", "to": "issuance", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "cert", "to": "revocation", "label": "1 : 0..1", "from_side": "s1", "to_side": "n", "kind": "optional" }, { "from": "endpoint", "to": "obs", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "bundle", "to": "report", "label": "1 : N", "from_side": "s", "to_side": "n" } ], "note": "observation.observed_serial is the foreign key that carries the architecture: a certificate reaches SERVING only because an observation points at it, and an observation whose serial resolves to nothing is an unmanaged certificate.", "meta": { "v": "1.0", "owner": "Data Architecture", "date": "2026-09" } }, { "id": "12-public-issuance-sequence", "title": "Critical Flow — A Customer Domain from CNAME to Padlock", "layout": "sequence", "lifelines": [ { "id": "tenant", "label": "Tenant admin", "kind": "actor" }, { "id": "order", "label": "Order manager", "kind": "app" }, { "id": "validator", "label": "Delegation checker", "kind": "app" }, { "id": "acme", "label": "ACME client", "kind": "integration" }, { "id": "ca", "label": "Public CA", "kind": "external" }, { "id": "dns", "label": "Route 53 zone", "kind": "integration" }, { "id": "edge", "label": "ACM and edge", "kind": "app" }, { "id": "prober", "label": "Endpoint prober", "kind": "platform" } ], "messages": [ { "from": "tenant", "to": "order", "label": "add support.acme-corp.com", "kind": "call" }, { "from": "order", "to": "order", "label": "denylist + tenant policy", "kind": "self" }, { "from": "order", "to": "tenant", "label": "one CNAME to create", "kind": "return" }, { "from": "tenant", "to": "dns", "label": "delegates to our zone", "kind": "async" }, { "from": "validator", "to": "dns", "label": "resolve _acme-challenge", "kind": "call" }, { "from": "validator", "to": "order", "label": "delegation confirmed", "kind": "return" }, { "from": "order", "to": "acme", "label": "place order", "kind": "call" }, { "from": "acme", "to": "ca", "label": "newOrder", "kind": "call" }, { "from": "ca", "to": "acme", "label": "dns-01 token", "kind": "return" }, { "from": "acme", "to": "dns", "label": "publish TXT", "kind": "call" }, { "from": "ca", "to": "dns", "label": "validates via CNAME", "kind": "call" }, { "from": "ca", "to": "acme", "label": "certificate + SCTs", "kind": "return" }, { "from": "acme", "to": "edge", "label": "import and bind", "kind": "call" }, { "from": "prober", "to": "edge", "label": "TLS handshake", "kind": "call" }, { "from": "prober", "to": "order", "label": "serial matches — SERVING", "kind": "return" }, { "from": "order", "to": "tenant", "label": "domain is live", "kind": "return" } ], "note": "The customer acts once, at step 4. Every renewal for the life of the domain re-enters at step 7, because the delegation the tenant created is permanent and the challenge is answered inside our own zone.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "13-renewal-and-verification-sequence", "title": "Critical Flow — Renewal Is Not Done Until It Is Observed", "layout": "sequence", "lifelines": [ { "id": "wl", "label": "Workload", "kind": "app", "icon": "kubernetes" }, { "id": "order", "label": "Order manager", "kind": "app" }, { "id": "att", "label": "Attestation verifier", "kind": "security" }, { "id": "pca", "label": "AWS Private CA", "kind": "security" }, { "id": "sds", "label": "Mesh SDS", "kind": "integration" }, { "id": "reg", "label": "Registry", "kind": "store", "icon": "aws_amazon-dynamodb" }, { "id": "prober", "label": "Endpoint prober", "kind": "platform" }, { "id": "esc", "label": "Escalation", "kind": "platform" } ], "messages": [ { "from": "wl", "to": "order", "label": "CSR + projected token", "kind": "call" }, { "from": "order", "to": "att", "label": "verify IRSA token", "kind": "call" }, { "from": "att", "to": "order", "label": "identity = ns/svc", "kind": "return" }, { "from": "order", "to": "pca", "label": "issue, 24 h profile", "kind": "call" }, { "from": "pca", "to": "order", "label": "leaf + chain", "kind": "return" }, { "from": "order", "to": "reg", "label": "state = ISSUED", "kind": "call" }, { "from": "order", "to": "sds", "label": "push leaf + chain", "kind": "call" }, { "from": "sds", "to": "wl", "label": "new secret", "kind": "call" }, { "from": "wl", "to": "wl", "label": "reload listener", "kind": "self" }, { "from": "prober", "to": "wl", "label": "TLS handshake", "kind": "call" }, { "from": "prober", "to": "reg", "label": "observed serial", "kind": "call" }, { "from": "reg", "to": "reg", "label": "state = SERVING", "kind": "self" }, { "from": "prober", "to": "reg", "label": "serial unchanged", "kind": "error" }, { "from": "reg", "to": "esc", "label": "divergence at T-8 h", "kind": "error" }, { "from": "esc", "to": "order", "label": "re-push and re-trigger reload", "kind": "error" } ], "note": "Messages 13 to 15 are the alternate path, and the reason this view exists: the certificate was issued successfully, the secret was written successfully, and the workload is still presenting the old one.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "14-issuance-paths", "title": "Issuance Paths by Trust Domain", "layout": "swimlane", "laneHeaderWidth": 175, "stages": [ "Prove entitlement", "Authorise", "Sign", "Install", "Verify", "Renew" ], "lanes": [ { "title": "Public trust — customer domains", "cells": [ [ { "label": "CNAME delegation", "kind": "integration" }, { "label": "HTTP-01 fallback", "kind": "integration" } ], [ { "label": "Tenant owns domain", "kind": "security" } ], [ { "label": "Public CA", "sub": "ACME, 90 d", "kind": "external" } ], [ { "label": "ACM + edge bind", "kind": "app" } ], [ { "label": "Probe the hostname", "kind": "app" }, { "label": "CT watch", "kind": "app" } ], [ { "label": "At 30 d left", "kind": "app" } ] ] }, { "title": "Private trust — workload identity", "cells": [ [ { "label": "IRSA token", "kind": "security" }, { "label": "IMDSv2 document", "kind": "security" } ], [ { "label": "Namespace policy", "kind": "security" } ], [ { "label": "AWS Private CA", "sub": "24 h leaf", "kind": "security" } ], [ { "label": "Mesh SDS", "kind": "integration" }, { "label": "Node agent", "kind": "integration" } ], [ { "label": "Probe the listener", "kind": "app" } ], [ { "label": "At 8 h left", "kind": "app" } ] ] }, { "title": "Trust plane — authorities", "cells": [ [ { "label": "Ceremony quorum", "kind": "security" } ], [ { "label": "Two-person control", "kind": "decision" } ], [ { "label": "Offline root", "sub": "CloudHSM", "kind": "security" } ], [ { "label": "Signed bundle", "kind": "security" } ], [ { "label": "Version report", "sub": "per relying party", "kind": "app" } ], [ { "label": "Rotate at half life", "kind": "app" } ] ] } ], "note": "The two trust domains share a registry, an escalation ladder and a verify step, and share nothing else. That is the whole argument for one control plane over two.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "15-revocation-and-bulk-reissue", "title": "Revocation and Bulk Re-Issuance Under an External Deadline", "layout": "flow", "chain": true, "align": "middle", "stages": [ { "title": "Trigger", "nodes": [ { "id": "r1a", "label": "Key compromise", "kind": "risk" }, { "id": "r1b", "label": "CA mandate", "sub": "24 h or 5 d", "kind": "risk" }, { "id": "r1c", "label": "Intermediate distrust", "kind": "risk" } ] }, { "title": "Decide", "nodes": [ { "id": "r2a", "label": "Blast radius query", "sub": "registry by authority", "kind": "app" }, { "id": "r2b", "label": "Two-person approval", "kind": "decision" } ] }, { "title": "Re-issue first", "nodes": [ { "id": "r3a", "label": "Bulk order queue", "sub": "rate-limit aware", "kind": "queue" }, { "id": "r3b", "label": "Second CA account", "sub": "pre-validated", "kind": "external" } ] }, { "title": "Install and verify", "nodes": [ { "id": "r4a", "label": "Delivery adapters", "kind": "integration" }, { "id": "r4b", "label": "Probe sweep", "sub": "new serial serving", "kind": "app" } ] }, { "title": "Revoke", "nodes": [ { "id": "r5a", "label": "Revocation record", "sub": "reason + actor", "kind": "store" }, { "id": "r5b", "label": "CRL and OCSP", "sub": "≤ 5 min p95", "kind": "integration" } ] }, { "title": "Evidence", "nodes": [ { "id": "r6a", "label": "Deadline report", "sub": "≤ 18 h of 24 h", "kind": "platform" }, { "id": "r6b", "label": "Rehearsal record", "sub": "twice a year", "kind": "store" } ] } ], "edges": [ { "from": "r4b", "to": "r3a", "label": "not yet serving", "kind": "error", "route": "gutter" } ], "note": "Re-issue precedes revoke on purpose. Revoking first turns a compromise into a self-inflicted outage; for a key known to be in an attacker's hands, the order inverts and the outage is accepted.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "16-deployment-architecture", "title": "Certificate Lifecycle Service — Deployment Architecture", "layout": "nested", "canvas": { "width": 1740 }, "boxes": [ { "title": "AWS — PKI platform account", "kind": "cloud", "dir": "col", "children": [ { "title": "eu-west-1 — primary, 3 AZ", "kind": "boundary", "nodes": [ { "id": "p1", "label": "Control plane", "sub": "EKS, 3 AZ", "kind": "app", "icon": "aws_amazon-elastic-kubernetes-service" }, { "id": "p2", "label": "AWS Private CA", "sub": "2 issuing CAs", "kind": "security" }, { "id": "p3", "label": "CloudHSM cluster", "sub": "3 HSMs", "kind": "security" }, { "id": "p4", "label": "Registry", "sub": "DynamoDB global table", "kind": "store", "icon": "aws_amazon-dynamodb" }, { "id": "p5", "label": "Ledger", "sub": "S3 Object Lock", "kind": "store", "icon": "aws_amazon-simple-storage-service" } ] }, { "title": "eu-central-1 and us-east-1 — verification and standby", "kind": "boundary", "nodes": [ { "id": "p6", "label": "Standby control plane", "sub": "warm, reads replica", "kind": "app" }, { "id": "p7", "label": "Endpoint probers", "sub": "one per region", "kind": "app" }, { "id": "p8", "label": "CRL and OCSP", "sub": "CloudFront, global", "kind": "integration" } ] } ] }, { "title": "Offline — not on any network", "kind": "onprem", "dir": "row", "children": [ { "title": "Ceremony facility", "kind": "trust", "nodes": [ { "id": "p9", "label": "Offline root", "sub": "hardware, quorum", "kind": "security" }, { "id": "p10", "label": "Ceremony record", "sub": "witnessed, filmed", "kind": "store" } ] } ] } ], "outside": [ { "id": "q1", "label": "Workload clusters", "sub": "6 EKS, 3 regions", "kind": "app" }, { "id": "q2", "label": "Edge estate", "sub": "CloudFront · ALB", "kind": "app" }, { "id": "q3", "label": "Public CA", "kind": "external" } ], "edges": [ { "from": "p7", "to": "q1", "label": "probe", "kind": "sync" }, { "from": "p3", "to": "p9", "label": "key backup", "kind": "batch" } ], "note": "The probers are deployed per region and read the estate from outside the control plane's failure domain, so a control-plane outage does not also blind the verification plane. Survival without the control plane is 8 hours, set by the 24-hour leaf renewed at one third of life.", "meta": { "v": "1.0", "owner": "Platform Engineering", "date": "2026-09" } }, { "id": "17-authority-rotation", "title": "Authority Rotation and Policy Release", "layout": "flow", "chain": true, "align": "middle", "stages": [ { "title": "Author", "nodes": [ { "id": "t1a", "label": "Policy pull request", "sub": "hierarchy · profiles", "kind": "app" }, { "id": "t1b", "label": "New intermediate", "sub": "ceremony scheduled", "kind": "security" } ] }, { "title": "Review", "nodes": [ { "id": "t2a", "label": "Two-person approval", "kind": "decision" }, { "id": "t2b", "label": "Constraint check", "sub": "EKU · name constraints", "kind": "security" } ] }, { "title": "Distribute trust", "nodes": [ { "id": "t3a", "label": "Bundle builder", "sub": "signed, versioned", "kind": "security" }, { "id": "t3b", "label": "Push to relying parties", "kind": "integration" } ] }, { "title": "Confirm coverage", "nodes": [ { "id": "t4a", "label": "Version reports", "sub": "target 100%", "kind": "app" }, { "id": "t4b", "label": "Rotation gate", "sub": "blocks below 100%", "kind": "decision" } ] }, { "title": "Enable issuance", "nodes": [ { "id": "t5a", "label": "New intermediate live", "kind": "security" }, { "id": "t5b", "label": "Canary identity", "sub": "issued and probed", "kind": "app" } ] }, { "title": "Drain the old", "nodes": [ { "id": "t6a", "label": "Old intermediate", "sub": "trusted, not issuing", "kind": "security" }, { "id": "t6b", "label": "Retire at last expiry", "sub": "bounded by leaf life", "kind": "app" } ] } ], "edges": [ { "from": "t4b", "to": "t3b", "label": "unreported party", "kind": "error", "route": "gutter" } ], "note": "A relying party that cannot report its bundle version blocks the rotation by name. That is the mechanism which stops the classic failure: issuing from an authority half the estate does not yet trust.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "18-observability", "title": "Observability and the Expiry Clock", "layout": "grid", "columns": [ "Emit", "Collect", "Store", "Consume", "Act" ], "rows": [ { "title": "Expiry clock", "cells": [ [ { "id": "e1", "label": "Probe result", "sub": "observed not_after", "kind": "app" } ], [ { "id": "e2", "label": "Divergence detector", "kind": "integration" } ], [ { "id": "e3", "label": "Observed index", "kind": "store" } ], [ { "id": "e4", "label": "Shortest-life board", "kind": "platform" } ], [ { "id": "e5", "label": "Page under 7 days", "kind": "security" } ] ] }, { "title": "Renewal health", "cells": [ [ { "id": "n1", "label": "Attempt outcome", "kind": "app" } ], [ { "id": "n2", "label": "Attempt ledger", "kind": "integration" } ], [ { "id": "n3", "label": "Registry", "kind": "store", "icon": "aws_amazon-dynamodb" } ], [ { "id": "n4", "label": "Escalation ladder", "sub": "30 / 21 / 14 / 7 d", "kind": "platform" } ], [ { "id": "n5", "label": "Incident at first fail", "kind": "security" } ] ] }, { "title": "Issuance and signing", "cells": [ [ { "id": "s1", "label": "CA metrics", "sub": "latency · rate limit", "kind": "app" } ], [ { "id": "s2", "label": "OTel collector", "kind": "integration" } ], [ { "id": "s3", "label": "Metric store", "kind": "store" } ], [ { "id": "s4", "label": "SLO dashboard", "sub": "p99 ≤ 250 ms", "kind": "platform" } ], [ { "id": "s5", "label": "Shift CA account", "kind": "security" } ] ] }, { "title": "Trust distribution", "cells": [ [ { "id": "b1", "label": "Bundle version", "kind": "app" } ], [ { "id": "b2", "label": "Report collector", "kind": "integration" } ], [ { "id": "b3", "label": "Coverage table", "kind": "store" } ], [ { "id": "b4", "label": "Rotation readiness", "kind": "platform" } ], [ { "id": "b5", "label": "Block the rotation", "kind": "security" } ] ] }, { "title": "Discovery coverage", "cells": [ [ { "id": "d1", "label": "Scan + CT watch", "kind": "app" } ], [ { "id": "d2", "label": "Reconciler", "kind": "integration" } ], [ { "id": "d3", "label": "Unmanaged findings", "kind": "store" } ], [ { "id": "d4", "label": "Coverage metric", "sub": "target ≥ 99.5%", "kind": "platform" } ], [ { "id": "d5", "label": "Owner + deadline", "kind": "security" } ] ] }, { "title": "Revocation reach", "cells": [ [ { "id": "v1", "label": "Synthetic revoke", "sub": "canary, daily", "kind": "app" } ], [ { "id": "v2", "label": "Propagation probe", "kind": "integration" } ], [ { "id": "v3", "label": "Reach history", "kind": "store" } ], [ { "id": "v4", "label": "Propagation p95", "sub": "≤ 5 min", "kind": "platform" } ], [ { "id": "v5", "label": "Escalate soft-fail", "kind": "security" } ] ] } ], "note": "The expiry clock is raised from the probe, not from the registry. A daily synthetic issue-install-revoke canary is what proves the whole path still works on a day nothing has gone wrong.", "meta": { "v": "1.0", "owner": "Reliability Architecture", "date": "2026-09" } }, { "id": "19-certificate-lifecycle-loop", "title": "The Certificate Lifecycle Loop", "layout": "cycle", "centre": { "label": "Managed identity", "icon": "fa5_certificate" }, "nodes": [ { "id": "y1", "label": "Declare", "kind": "security", "sub": "owner + profile" }, { "id": "y2", "label": "Prove entitlement", "kind": "decision", "sub": "domain or attestation" }, { "id": "y3", "label": "Issue", "kind": "security", "sub": "CSR in, chain out" }, { "id": "y4", "label": "Install and reload", "kind": "integration" }, { "id": "y5", "label": "Observe serving", "kind": "app", "sub": "the only truth" }, { "id": "y6", "label": "Approach expiry", "kind": "platform", "sub": "at 1/3 life" } ], "ringLabels": [ "owner attached", "control proved", "leaf + chain", "process reloaded", "serial confirmed", "renewal due" ], "note": "An identity is permanent; its certificates are not. Most designs draw this loop closing at 'issue', which is exactly the gap an expiry outage lives in.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "20-security-trust-zones", "title": "Security Trust Zones and Key Custody", "layout": "zones", "zones": [ { "title": "Internet — nothing here is trusted", "kind": "trust", "nodes": [ { "id": "g1", "label": "Browsers and clients", "kind": "external" }, { "id": "g2", "label": "Public CA", "sub": "ACME", "kind": "external" }, { "id": "g3", "label": "CT logs", "kind": "external" }, { "id": "g4", "label": "Customer DNS", "kind": "external" } ] }, { "title": "Published surface — read-only, higher availability than issuance", "kind": "trust", "nodes": [ { "id": "g5", "label": "CRL and OCSP", "sub": "CloudFront", "kind": "integration" }, { "id": "g6", "label": "Trust bundle mirror", "kind": "integration" }, { "id": "g7", "label": "Delegated DNS zone", "sub": "Route 53", "kind": "integration" } ] }, { "title": "Control plane — may request a signature, may never produce one", "kind": "trust", "nodes": [ { "id": "g8", "label": "Order manager", "kind": "app" }, { "id": "g9", "label": "Policy engine", "kind": "security" }, { "id": "g10", "label": "Registry", "kind": "store", "icon": "aws_amazon-dynamodb" }, { "id": "g11", "label": "Probers", "sub": "egress only", "kind": "app" } ] }, { "title": "Issuance plane — separate credentials, no standing human access", "kind": "trust", "nodes": [ { "id": "g12", "label": "Attestation verifier", "kind": "security" }, { "id": "g13", "label": "Issuing intermediates", "kind": "security" }, { "id": "g14", "label": "Issuance ledger", "sub": "write-once", "kind": "store" } ] }, { "title": "Key custody — hardware, two-person, offline root", "kind": "trust", "nodes": [ { "id": "g15", "label": "Online signing modules", "sub": "FIPS 140-2 L3", "kind": "security" }, { "id": "g16", "label": "Offline root", "sub": "ceremony only", "kind": "security" } ] } ], "edges": [ { "from": "g1", "to": "g5", "label": "revocation check", "kind": "sync" }, { "from": "g8", "to": "g2", "label": "ACME", "kind": "sync" }, { "from": "g8", "to": "g13", "label": "signed request", "kind": "sync" }, { "from": "g13", "to": "g15", "label": "PKCS#11", "kind": "sync" }, { "from": "g15", "to": "g16", "label": "ceremony only", "kind": "batch" } ], "note": "The probers sit in the control plane with egress only and reach the estate's endpoints, which are not drawn here. The root is inside the zones it protects but has no path to any of them: it is reached by people in a room, not by a service. The published surface is deliberately the most available tier, because relying parties the platform does not control depend on it.", "meta": { "v": "1.0", "owner": "Security Architecture", "date": "2026-09" } }, { "id": "21-identity-and-authorisation", "title": "Identity and Authorisation — And the Request That Must Be Refused", "layout": "sequence", "lifelines": [ { "id": "wl", "label": "Workload in ns-a", "kind": "app" }, { "id": "api", "label": "Issuance API", "kind": "integration" }, { "id": "att", "label": "Attestation verifier", "kind": "security" }, { "id": "pol", "label": "Policy engine", "kind": "security" }, { "id": "ca", "label": "Issuing CA", "kind": "security" }, { "id": "led", "label": "Issuance ledger", "kind": "store" }, { "id": "adm", "label": "PKI administrator", "kind": "actor" } ], "messages": [ { "from": "wl", "to": "api", "label": "CSR for ns-a/payments", "kind": "call" }, { "from": "api", "to": "att", "label": "projected SA token", "kind": "call" }, { "from": "att", "to": "api", "label": "cluster · ns-a · payments", "kind": "return" }, { "from": "api", "to": "pol", "label": "may this identity ask?", "kind": "call" }, { "from": "pol", "to": "api", "label": "allow, profile mesh-leaf", "kind": "return" }, { "from": "api", "to": "ca", "label": "sign under constraints", "kind": "call" }, { "from": "ca", "to": "led", "label": "append issuance event", "kind": "call" }, { "from": "ca", "to": "wl", "label": "leaf + chain, 24 h", "kind": "return" }, { "from": "wl", "to": "api", "label": "CSR for ns-b/treasury", "kind": "error" }, { "from": "api", "to": "pol", "label": "cross-namespace subject", "kind": "error" }, { "from": "pol", "to": "api", "label": "deny — not this identity's", "kind": "error" }, { "from": "api", "to": "led", "label": "append denial", "kind": "error" }, { "from": "adm", "to": "pol", "label": "relax a constraint", "kind": "call" }, { "from": "pol", "to": "adm", "label": "second approver required", "kind": "return" } ], "note": "Messages 9 to 12 are the request the platform exists to refuse, and message 12 matters as much as message 11: a denial that is not recorded cannot be investigated. The administrator path shows that changing the rule is itself a two-person operation.", "meta": { "v": "1.0", "owner": "Security Architecture", "date": "2026-09" } } ]