File Upload & Scanning Pipeline  ·  View 07 of 21  ·  Structure

Layered Architecture

Eight layers, two of them storage, and one crossing rule that makes the whole set legible.

Editable source SVG draw.io All views
Clients Web client Mobile client Desktop sync Product backends Admin console Edge & API Front Door WAF, TLS API gateway authn, quota Admission checks size, type, scope Control plane Session service Credential minting Lifecycle state machine Policy resolver Reconciler stuck objects Scan plane Priority queues 3 lanes Dispatcher profile by size Signature engine sandboxed job Deep engine sandboxed job Verdict composer Storage — untrusted Unscanned no read path Quarantine 180 d evidence Open-session chunks 7 d Storage — serving Available objects 12 PB Edge cache available only Metadata & evidence Object metadata strongly consistent Verdict store hash × engine ver Dedup index Transition log append-only, immutable Operations Oldest-unscanned age the SLO that matters Signature freshness Quarantine console Cost attribution reject pre-bytes enqueue record promote Layered Architecture — Eight Layers, One Crossing Rule External / third party Interface / broker Decision point Application we own Security / platform Queue / topic Data store failure / alternate synchronous event / async One crossing rule: nothing in the serving layer may be reached without the control plane's state machine saying so, and no client ever addresses the untrusted layer for reading. v 1.0 · stack Microsoft Azure

Decisions

  • Storage is two layers rather than one, because the isolation claim is structural: the untrusted layer has no issuable read credential, not merely a flag that says it should not be read
  • The control plane holds no bytes and the scan plane holds no authority — neither layer can both see an object and decide its fate
  • Operations is a layer, not a footnote: oldest-unscanned age is the signal the whole scan plane is scaled and alarmed on

The crossing rule

  • No client ever addresses the untrusted storage layer for reading, and nothing in the serving layer is reachable without the control plane's state machine saying so
  • The only backwards arrow in the set runs from the scan plane to the admission gate: saturation downstream is expressed as refusal at the front door
  • Admission rejects before bytes move — a rejection that costs the client a six-hour upload is a design defect, not a policy

Deliberately omitted

  • Preview, indexing and DLP, which subscribe to layer 7 rather than living in it
  • Tenant product logic — this platform knows scopes and policies, never conversations or documents
◀  Journey — Review and Release a Blocked File All views Platform Components  ▶
Solution Architecture v1.0 · Microsoft Azure · Integration Platform Architecture · 2026-1007-layered-architecture