File Upload & Scanning Pipeline  ·  View 16 of 21  ·  Runtime

Download Path

Four checks before any byte moves, and the five minutes that bound a revocation.

Editable source SVG draw.io All views
Ask Reader Download API p99 ≤ 80 ms Check Authorise now not at upload time State = available? re-read, every call Verdict current? not revoked Mint Read-only SAS one object, 5 min Disposition headers inline only if allow-listed Serve Front Door available objects only Serving plane direct, no platform compute Revoke Re-scan / new intel signature change Verdict revoked state -> quarantined Demote + purge edge ≤ 60 s cache invalidated Download Path — Four Checks Before Any Byte Moves Person or role Interface / broker Decision point Security / platform Application we own Data store failure / alternate event / async A revocation cannot recall a credential already issued, so the credential's 5-minute life is the real bound on exposure. That is why it is minutes and not hours, and why it is a requirement rather than a tuning choice. v 1.0 · exposure-bound 5 min in-flight, 60 s to demote

Decisions

  • Authorisation, lifecycle state and verdict currency are all re-evaluated at request time; nothing is cached from the upload decision
  • Bytes are served direct from the store or the edge, never through platform compute, and nothing is cached at the edge before an object is available
  • Any content type not on the scope's inline-render allow-list is served with headers that force download rather than in-browser rendering

The exposure bound

  • A revocation cannot recall a credential already issued, so the credential's 5-minute life is the real bound on post-revocation exposure
  • Demotion from the serving plane and edge invalidation complete within 60 seconds; the two numbers together are the honest statement of blast radius
  • This is why the read credential is minutes rather than hours — a requirement derived from revocation, not a tuning preference

Stated assumptions

  • Credential issuance p99 ≤ 80 ms, availability ≥ 99.99% monthly
  • Revocation removes an object from the serving plane within 60 s
  • Re-scan of objects clean within the last 30 days within 24 h of a material signature change
◀  Back-Pressure — Which Promise Breaks First All views Deployment Architecture  ▶
Solution Architecture v1.0 · Microsoft Azure · Integration Platform Architecture · 2026-1016-download-path