[ { "id": "01-system-context", "title": "System Context — File Upload & Scanning Pipeline", "layout": "context", "canvas": { "width": 2200 }, "colWidth": 310, "system": { "label": "File Upload & Scanning Pipeline", "sub": "Accept · scan · quarantine · serve" }, "groups": [ { "side": "left", "title": "People and public submitters", "nodes": [ { "id": "member", "label": "Workspace member", "kind": "actor", "rel": "attaches", "dir": "in" }, { "id": "secadmin", "label": "Tenant security admin", "kind": "actor", "rel": "reviews", "dir": "in" }, { "id": "soc", "label": "Platform security analyst", "kind": "actor", "rel": "break-glass", "dir": "in" }, { "id": "forms", "label": "Forms & intake product", "kind": "external", "rel": "public intake", "dir": "in" } ] }, { "side": "top", "title": "Product tenants (callers)", "nodes": [ { "id": "sync", "label": "Desktop sync client", "kind": "external", "sub": "folder sync, bulk lane" }, { "id": "chat", "label": "Chat product", "kind": "external", "rel": "attachments", "dir": "in" }, { "id": "wiki", "label": "Docs & wiki product", "kind": "external", "rel": "page files", "dir": "in" } ] }, { "side": "right", "title": "Platform dependencies", "nodes": [ { "id": "entra", "label": "Workforce & customer IdP", "kind": "security", "sub": "Microsoft Entra ID", "rel": "authn", "dir": "in" }, { "id": "feed", "label": "Signature & intel feed", "kind": "external", "sub": "vendor, pulled", "rel": "signatures", "dir": "in" }, { "id": "engines", "label": "Scan engine vendors", "kind": "external", "sub": "licensed images", "rel": "engine images", "dir": "in" }, { "id": "kv", "label": "Key management", "kind": "security", "sub": "Key Vault / Managed HSM", "rel": "tenant keys", "dir": "in" } ] }, { "side": "bottom", "title": "Event consumers (out of scope)", "nodes": [ { "id": "preview", "label": "Preview & thumbnail service", "kind": "external", "rel": "available" }, { "id": "dlp", "label": "DLP classification", "kind": "external", "rel": "verdicts" }, { "id": "siem", "label": "Security SIEM", "kind": "external", "rel": "detections" }, { "id": "notify", "label": "Notification service", "kind": "external", "rel": "state" } ] } ], "meta": { "v": "1.0", "stack": "Microsoft Azure", "scope": "attachment plane for 12 product tenants" }, "edges": [ { "from": "sync", "to": "system" } ] }, { "id": "02-high-level", "title": "High-Level Architecture — Five Stages, One Seam", "layout": "flow", "canvas": { "width": 1820 }, "chain": true, "align": "middle", "stages": [ { "title": "Admit", "nodes": [ { "id": "api", "label": "Upload API", "sub": "initiate · finalise", "kind": "integration" }, { "id": "mint", "label": "Credential minting", "sub": "user-delegation SAS, 1 path", "kind": "security" } ] }, { "title": "Transfer", "nodes": [ { "id": "untrusted", "label": "Untrusted plane", "sub": "Blob, no read path", "kind": "store" }, { "id": "session", "label": "Session & chunk state", "sub": "resumable 7 days", "kind": "store" } ] }, { "title": "Identify", "nodes": [ { "id": "finalise", "label": "Finalise & verify", "sub": "chunk set + whole-object hash", "kind": "app" }, { "id": "dedup", "label": "Content identity", "sub": "hash, type by inspection", "kind": "app" } ] }, { "title": "Decide", "nodes": [ { "id": "queues", "label": "Priority scan queues", "sub": "interactive · background · bulk", "kind": "queue" }, { "id": "workers", "label": "Sandboxed scan workers", "sub": "ephemeral, egress-restricted", "kind": "app" }, { "id": "verdict", "label": "Verdict store", "sub": "hash × engine version", "kind": "store" } ] }, { "title": "Serve", "nodes": [ { "id": "state", "label": "Lifecycle state machine", "sub": "the only gatekeeper", "kind": "app" }, { "id": "serving", "label": "Serving plane", "sub": "available objects only", "kind": "store" }, { "id": "edge", "label": "Edge delivery", "sub": "Front Door", "kind": "integration" } ] } ], "edges": [ { "from": "mint", "to": "untrusted", "kind": "async" }, { "from": "finalise", "to": "queues", "label": "enqueue once" }, { "from": "workers", "to": "verdict", "label": "verdict row" }, { "from": "state", "to": "serving", "label": "promote", "kind": "async" }, { "from": "state", "to": "edge", "label": "read SAS", "kind": "sync" } ], "note": "Bytes (dashed) go client-to-store and never through platform compute; only control passes through the Upload API. The seam is between Decide and Serve: bytes exist from stage 2, access begins at stage 5.", "meta": { "v": "1.0", "seam": "state, not storage, grants access" } }, { "id": "03-actors-and-journeys", "title": "Actors and Their Core Journeys", "layout": "actors", "canvas": { "width": 1820 }, "cardWidth": 280, "groups": [ { "title": "The people who upload", "kind": "boundary", "actors": [ { "id": "member", "label": "Workspace member", "sub": "40 M monthly", "goal": "Drop a file into a conversation and have it simply be there for the people I am talking to.", "journeys": [ { "id": "j-attach", "label": "Attach a file to a chat" }, { "label": "Share a folder of photos" }, { "label": "Re-download it on another device" } ] }, { "id": "creator", "label": "Heavy-media creator", "sub": "p99 object 240 MB", "goal": "Get a 40 GB edit uploaded from a hotel network without starting again every time the lift eats the signal.", "journeys": [ { "id": "j-large", "label": "Upload a 40 GB master" }, { "label": "Resume after a dropped link" } ] }, { "id": "applicant", "label": "External submitter", "sub": "unauthenticated intake", "goal": "Send my CV to a company that has never heard of me, and be told it arrived.", "journeys": [ { "label": "Submit a document to a form" }, { "label": "See that it was accepted" } ] } ] }, { "title": "The people who answer for it", "kind": "trust", "actors": [ { "id": "secadmin", "label": "Tenant security admin", "sub": "12 tenants", "goal": "See what was blocked in my tenant, and release the one file my finance team swears is a spreadsheet.", "journeys": [ { "id": "j-review", "label": "Review and release a block" }, { "label": "Set scope policy and ceilings" } ] }, { "id": "soc", "label": "Platform security analyst", "sub": "24×7 rota", "goal": "Pull the actual sample for a detection without the sample ever reaching anything that could run it.", "journeys": [ { "label": "Break-glass read of evidence" }, { "label": "Force a corpus re-scan on new intel" } ] }, { "id": "sre", "label": "Platform SRE", "sub": "on call", "goal": "Know the scan backlog is growing before members start asking why attachments say scanning.", "journeys": [ { "label": "Watch oldest-unscanned age" }, { "label": "Shed a lane under load" } ] } ] }, { "title": "Machines that are also users", "kind": "cloud", "actors": [ { "id": "syncd", "label": "Desktop sync daemon", "kind": "external", "sub": "background lane", "goal": "Push a thousand small files without being throttled into next week, and without starving a human.", "journeys": [ { "label": "Bulk-sync a changed folder" } ] }, { "id": "migration", "label": "Tenant migration job", "kind": "platform", "sub": "bulk lane", "goal": "Move 8 TB of a customer's legacy share in a weekend, scanned, with no latency promise at all.", "journeys": [ { "label": "Bulk import a legacy share" } ] }, { "id": "rescan", "label": "Re-scan scheduler", "kind": "platform", "sub": "signature-triggered", "goal": "Re-judge everything recent when the signature set moves, inside the cold-read budget.", "journeys": [ { "label": "Re-scan the recent corpus" } ] } ] } ], "meta": { "v": "1.0", "note": "volumes are stated assumptions" } }, { "id": "04-journey-attach", "title": "Journey — Attach a File to a Conversation", "layout": "journey", "canvas": { "width": 1820 }, "actor": { "label": "Workspace member", "sub": "mobile and web", "goal": "Share a document in a conversation without thinking about it", "trigger": "Someone asks for the deck, in the thread, now", "success": "The other person opens it, and nobody saw the word scanning" }, "phases": [ { "title": "Pick", "sub": "in the client" }, { "title": "Send", "sub": "bytes leave" }, { "title": "Wait", "moment": true }, { "title": "Shared", "moment": true }, { "title": "Opened", "sub": "by someone else" } ], "lanes": [ { "title": "What they do", "kind": "step", "cells": [ [ { "label": "Drags a 4 MB PDF" } ], [ { "label": "Watches a progress bar" } ], [ { "label": "Sees \"checking file\"" } ], [ { "label": "Message posts" } ], [ { "label": "Colleague taps it" } ] ] }, { "title": "What the platform does", "kind": "system", "cells": [ [ { "label": "Initiate, mint SAS", "kind": "security" } ], [ { "label": "Direct-to-blob chunks", "kind": "store" } ], [ { "label": "Finalise, hash, enqueue", "kind": "queue" }, { "label": "Signature scan", "kind": "app" } ], [ { "label": "Promote to serving", "kind": "store" }, { "label": "Emit available event", "kind": "queue" } ], [ { "label": "Read SAS, state re-checked", "kind": "security" } ] ] }, { "title": "How it feels", "kind": "emotion", "levels": [ "Unaware", "Fine", "Suspicious" ], "points": [ 0, 0, 2, 0, 0 ] }, { "title": "Where it hurts", "kind": "pain", "cells": [ [], [], [ { "label": "2 s reads as broken" }, { "label": "\"Checking\" sounds like doubt" } ], [ { "label": "Posted before available" } ], [ { "label": "Revoked mid-read" } ] ] }, { "title": "What we do about it", "kind": "gain", "cells": [ [ { "label": "No size prompt under 10 MB" } ], [ { "label": "Parallel chunks, 16 ways" } ], [ { "label": "p50 verdict 2 s, interactive lane" }, { "label": "Optimistic post is a scope opt-in" } ], [ { "label": "Post waits on the event, not a poll" } ], [ { "label": "Short SAS bounds a revocation to minutes" } ] ] } ], "chain": true, "meta": { "v": "1.0", "lane": "interactive", "target": "p95 verdict 8 s under 10 MB" } }, { "id": "05-journey-large-upload", "title": "Journey — A 40 GB Master from a Bad Network", "layout": "journey", "canvas": { "width": 1820 }, "actor": { "label": "Heavy-media creator", "sub": "desktop, hotel wifi", "goal": "Get the finished edit into the shared folder overnight", "trigger": "A deadline tomorrow and one evening of bandwidth", "success": "It is there in the morning, whole, and playable" }, "phases": [ { "title": "Start", "sub": "declare size" }, { "title": "Transfer", "sub": "hours" }, { "title": "Interrupted", "moment": true }, { "title": "Finalise", "moment": true }, { "title": "Scanned", "sub": "minutes" } ], "lanes": [ { "title": "What they do", "kind": "step", "cells": [ [ { "label": "Drops a 40 GB file" } ], [ { "label": "Leaves it running" } ], [ { "label": "Lift, VPN flap, sleep" } ], [ { "label": "Comes back next morning" } ], [ { "label": "Shares the link" } ] ] }, { "title": "What the platform does", "kind": "system", "cells": [ [ { "label": "Ceiling check, 60 min SAS", "kind": "security" } ], [ { "label": "256 MB blocks, 16 parallel", "kind": "store" }, { "label": "Per-chunk checksum", "kind": "app" } ], [ { "label": "Session held 7 days", "kind": "store" }, { "label": "SAS renewed in session", "kind": "security" } ], [ { "label": "Chunk-set + hash assert", "kind": "app" } ], [ { "label": "Large-object profile scan", "kind": "app" }, { "label": "Archive bounds enforced", "kind": "decision" } ] ] }, { "title": "How it feels", "kind": "emotion", "levels": [ "Confident", "Uneasy", "Despairing" ], "points": [ 1, 1, 2, 1, 0 ] }, { "title": "Where it hurts", "kind": "pain", "cells": [ [ { "label": "No idea if 40 GB is allowed" } ], [], [ { "label": "Fear of starting over" }, { "label": "Credential expired" } ], [ { "label": "Silent truncation" } ], [ { "label": "20 min of \"scanning\"" } ] ] }, { "title": "What we do about it", "kind": "gain", "cells": [ [ { "label": "Ceiling rejected at initiate, pre-bytes" } ], [ { "label": "A drop costs one chunk" } ], [ { "label": "Query stored chunks, send the gap" } ], [ { "label": "Refuse to assemble a mismatch" } ], [ { "label": "State and reason shown, not a spinner" } ] ] } ], "chain": true, "meta": { "v": "1.0", "lane": "background", "target": "p95 verdict 20 min at 50 GB" } }, { "id": "06-journey-quarantine-review", "title": "Journey — Review and Release a Blocked File", "layout": "journey", "canvas": { "width": 1820 }, "actor": { "label": "Tenant security admin", "sub": "one of 12 tenants", "goal": "Decide, with evidence, whether a blocked file is a threat or a bad signature", "trigger": "A finance lead says the quarterly model will not upload", "success": "A reasoned, audited decision — and the next identical file behaves the same way" }, "phases": [ { "title": "Told", "sub": "by a user" }, { "title": "Look", "sub": "console" }, { "title": "Judge", "moment": true }, { "title": "Act", "moment": true }, { "title": "Account", "sub": "later" } ], "lanes": [ { "title": "What they do", "kind": "step", "cells": [ [ { "label": "Gets the complaint" } ], [ { "label": "Finds the object" } ], [ { "label": "Reads the evidence" } ], [ { "label": "Releases, with a reason" } ], [ { "label": "Answers an auditor" } ] ] }, { "title": "What the platform does", "kind": "system", "cells": [ [ { "label": "Blocked state surfaced to user", "kind": "app" } ], [ { "label": "Quarantine console, no bytes", "kind": "security" } ], [ { "label": "Engine, version, detection id", "kind": "store" }, { "label": "Determined vs claimed type", "kind": "app" } ], [ { "label": "Release requires reason + role", "kind": "decision" }, { "label": "Transition logged immutably", "kind": "store" } ], [ { "label": "7-year verdict provenance", "kind": "store" } ] ] }, { "title": "How it feels", "kind": "emotion", "levels": [ "In control", "Unsure", "Exposed" ], "points": [ 1, 1, 2, 1, 0 ] }, { "title": "Where it hurts", "kind": "pain", "cells": [ [ { "label": "User saw a generic failure" } ], [ { "label": "Cannot tell block from bug" } ], [ { "label": "Wants to open it to be sure" } ], [ { "label": "Release feels like a dare" } ], [] ] }, { "title": "What we do about it", "kind": "gain", "cells": [ [ { "label": "State and reason, not an error code" } ], [ { "label": "Indeterminate is its own verdict" } ], [ { "label": "Bytes stay unreachable; break-glass is a separate role" } ], [ { "label": "Infected cannot be released by this path at all" } ], [ { "label": "Appeal closes within 4 business hours" } ] ] } ], "chain": true, "meta": { "v": "1.0", "fp-budget": "≤ 0.01% of clean objects" } }, { "id": "07-layered-architecture", "title": "Layered Architecture — Eight Layers, One Crossing Rule", "layout": "bands", "canvas": { "width": 1900 }, "layerHeaderWidth": 170, "bands": [ { "name": "Clients", "nodes": [ { "id": "web", "label": "Web client", "kind": "external" }, { "id": "mob", "label": "Mobile client", "kind": "external" }, { "id": "desk", "label": "Desktop sync", "kind": "external" }, { "id": "svc", "label": "Product backends", "kind": "external" }, { "id": "console", "label": "Admin console", "kind": "external" } ] }, { "name": "Edge & API", "nodes": [ { "id": "fd", "label": "Front Door", "sub": "WAF, TLS", "kind": "integration" }, { "id": "apim", "label": "API gateway", "sub": "authn, quota", "kind": "integration" }, { "id": "admit", "label": "Admission checks", "sub": "size, type, scope", "kind": "decision" } ] }, { "name": "Control plane", "nodes": [ { "id": "sessionsvc", "label": "Session service", "kind": "app" }, { "id": "mintsvc", "label": "Credential minting", "kind": "security" }, { "id": "fsm", "label": "Lifecycle state machine", "kind": "app" }, { "id": "policy", "label": "Policy resolver", "kind": "app" }, { "id": "recon", "label": "Reconciler", "sub": "stuck objects", "kind": "app" } ] }, { "name": "Scan plane", "nodes": [ { "id": "lanes", "label": "Priority queues", "sub": "3 lanes", "kind": "queue" }, { "id": "disp", "label": "Dispatcher", "sub": "profile by size", "kind": "app" }, { "id": "sig", "label": "Signature engine", "sub": "sandboxed job", "kind": "app" }, { "id": "deep", "label": "Deep engine", "sub": "sandboxed job", "kind": "app" }, { "id": "compose", "label": "Verdict composer", "kind": "app" } ] }, { "name": "Storage — untrusted", "nodes": [ { "id": "unscanned", "label": "Unscanned", "sub": "no read path", "kind": "store" }, { "id": "quar", "label": "Quarantine", "sub": "180 d evidence", "kind": "store" }, { "id": "chunks", "label": "Open-session chunks", "sub": "7 d", "kind": "store" } ] }, { "name": "Storage — serving", "nodes": [ { "id": "avail", "label": "Available objects", "sub": "12 PB", "kind": "store" }, { "id": "cache", "label": "Edge cache", "sub": "available only", "kind": "store" } ] }, { "name": "Metadata & evidence", "nodes": [ { "id": "objmeta", "label": "Object metadata", "sub": "strongly consistent", "kind": "store" }, { "id": "vstore", "label": "Verdict store", "sub": "hash × engine ver", "kind": "store" }, { "id": "ddx", "label": "Dedup index", "kind": "store" }, { "id": "tlog", "label": "Transition log", "sub": "append-only, immutable", "kind": "store" } ] }, { "name": "Operations", "nodes": [ { "id": "slo", "label": "Oldest-unscanned age", "sub": "the SLO that matters", "kind": "platform" }, { "id": "sigfresh", "label": "Signature freshness", "kind": "platform" }, { "id": "qconsole", "label": "Quarantine console", "kind": "platform" }, { "id": "cost", "label": "Cost attribution", "kind": "platform" } ] } ], "edges": [ { "from": "admit", "to": "fsm", "label": "reject pre-bytes", "kind": "error" }, { "from": "fsm", "to": "lanes", "label": "enqueue" }, { "from": "compose", "to": "vstore", "label": "record" }, { "from": "fsm", "to": "avail", "label": "promote", "kind": "async" } ], "note": "One crossing rule: nothing in the serving layer may be reached without the control plane's state machine saying so, and no client ever addresses the untrusted layer for reading.", "meta": { "v": "1.0", "stack": "Microsoft Azure" } }, { "id": "08-platform-components", "title": "Platform Components — Three Subscriptions, Two Planes", "layout": "nested", "canvas": { "width": 1960 }, "boxes": [ { "title": "Platform subscription — control", "kind": "cloud", "dir": "col", "children": [ { "title": "Edge & API", "kind": "boundary", "nodes": [ { "id": "fd", "label": "Front Door", "sub": "WAF", "kind": "integration" }, { "id": "apim", "label": "API gateway", "sub": "APIM", "kind": "integration" } ] }, { "title": "Control services — Container Apps", "kind": "boundary", "nodes": [ { "id": "sessionsvc", "label": "Session service", "kind": "app" }, { "id": "mintsvc", "label": "Credential minting", "sub": "user-delegation SAS", "kind": "security" }, { "id": "fsm", "label": "Lifecycle state machine", "kind": "app" }, { "id": "policy", "label": "Policy resolver", "kind": "app" }, { "id": "recon", "label": "Reconciler", "kind": "app" } ] }, { "title": "Metadata & evidence", "kind": "boundary", "nodes": [ { "id": "objmeta", "label": "Object metadata", "sub": "Cosmos DB", "kind": "store" }, { "id": "vstore", "label": "Verdict store", "sub": "Cosmos DB", "kind": "store" }, { "id": "ddx", "label": "Dedup index", "sub": "Cosmos DB", "kind": "store" }, { "id": "tlog", "label": "Transition log", "sub": "Blob, immutable", "kind": "store" } ] } ] }, { "title": "Scan subscription — isolated, no inbound", "kind": "trust", "dir": "col", "children": [ { "title": "Work intake", "kind": "lane", "nodes": [ { "id": "eg", "label": "Finalise events", "sub": "Event Grid", "kind": "queue" }, { "id": "lanes", "label": "Priority queues", "sub": "Service Bus ×3", "kind": "queue" }, { "id": "disp", "label": "Dispatcher", "sub": "size profile", "kind": "app" } ] }, { "title": "Ephemeral sandboxed workers", "kind": "boundary", "nodes": [ { "id": "sig", "label": "Signature engine", "sub": "Container Apps job", "kind": "app" }, { "id": "deep", "label": "Deep engine", "sub": "Container Apps job", "kind": "app" }, { "id": "expand", "label": "Archive expander", "sub": "bounded depth 12", "kind": "app" }, { "id": "compose", "label": "Verdict composer", "kind": "app" }, { "id": "dlq", "label": "Poison dead-letter", "sub": "indeterminate", "kind": "risk" } ] } ] }, { "title": "Storage subscription", "kind": "cloud", "dir": "col", "children": [ { "title": "Untrusted plane — deny by default", "kind": "trust", "nodes": [ { "id": "unscanned", "label": "Unscanned", "kind": "store" }, { "id": "quar", "label": "Quarantine", "kind": "store" }, { "id": "evid", "label": "Evidence", "sub": "immutable, 180 d", "kind": "store" } ] }, { "title": "Serving plane", "kind": "boundary", "nodes": [ { "id": "avail", "label": "Available objects", "kind": "store" } ] } ] } ], "outside": [ { "id": "entra", "label": "Entra ID", "kind": "security" }, { "id": "kv", "label": "Key Vault / HSM", "kind": "security" }, { "id": "feed", "label": "Signature feed", "kind": "external" }, { "id": "monitor", "label": "Azure Monitor", "kind": "platform" } ], "edges": [ { "from": "fsm", "to": "eg", "label": "finalised", "kind": "async" }, { "from": "compose", "to": "vstore", "label": "verdict" }, { "from": "fsm", "to": "avail", "label": "promote", "kind": "async" } ], "note": "The scan subscription has no inbound reachability and no credential that can change an object's state: it reads bytes and writes verdicts, and nothing else.", "meta": { "v": "1.0", "isolation": "scan plane in its own subscription" } }, { "id": "09-interface-catalogue", "title": "Interface Catalogue — Four Contracts In, Three Out", "layout": "hub", "canvas": { "width": 1900 }, "left": { "title": "Inbound", "nodes": [ { "id": "ctl", "label": "Upload control API", "sub": "initiate · chunks? · finalise", "rel": "OAuth 2.0" }, { "id": "bytes", "label": "Direct chunk write", "sub": "client to Blob, SAS", "rel": "bytes, not via us", "kind2": "async" }, { "id": "dl", "label": "Download credential API", "sub": "state re-checked per call", "rel": "per call" }, { "id": "adminapi", "label": "Policy & quarantine API", "sub": "tenant security admin", "rel": "role-gated" } ] }, "centre": { "title": "File Upload & Scanning Pipeline", "nodes": [ { "id": "core", "label": "Upload & scanning platform", "sub": "control in, bytes around" } ] }, "right": { "title": "Outbound", "nodes": [ { "id": "events", "label": "Verdict & state events", "sub": "available · blocked · revoked", "rel": "Event Grid", "dir": "out", "kind2": "async" }, { "id": "siem", "label": "Detections & audit", "sub": "immutable, 7 years", "rel": "stream", "dir": "out", "kind2": "async" }, { "id": "feedpull", "label": "Signature & engine feed", "sub": "pulled, staleness published", "rel": "hourly", "dir": "out", "kind2": "batch" } ] }, "note": "There are only two ways in for a client: a control call that returns a credential, and a byte write that uses one. Everything else is administration or a subscription.", "meta": { "v": "1.0", "contracts": "4 in, 3 out" } }, { "id": "10-data-flow", "title": "Data Flow — One File, Followed to the First Read", "layout": "flow", "canvas": { "width": 1960 }, "chain": true, "align": "middle", "stages": [ { "title": "Declare", "nodes": [ { "id": "client", "label": "Client", "kind": "external" }, { "id": "initiate", "label": "Initiate", "sub": "size, type, scope, key", "kind": "integration" }, { "id": "gate", "label": "Admission gate", "sub": "reject pre-bytes", "kind": "decision" } ] }, { "title": "Land", "nodes": [ { "id": "sas", "label": "Path-scoped SAS", "sub": "write only, 60 min", "kind": "security" }, { "id": "blocks", "label": "Blocks, 16 parallel", "sub": "per-chunk checksum", "kind": "store" }, { "id": "sessionst", "label": "Session state", "sub": "chunk set, 7 d", "kind": "store" } ] }, { "title": "Identify", "nodes": [ { "id": "fin", "label": "Finalise", "sub": "assert set + hash", "kind": "app" }, { "id": "sniff", "label": "Type by inspection", "sub": "claim recorded apart", "kind": "app" }, { "id": "cid", "label": "Content identity", "sub": "hash, dedup lookup", "kind": "app" } ] }, { "title": "Judge", "nodes": [ { "id": "lane", "label": "Lane admission", "sub": "interactive", "kind": "queue" }, { "id": "scan", "label": "Bounded scan", "sub": "time, memory, depth", "kind": "app" }, { "id": "vd", "label": "Composed verdict", "sub": "engine + sig version", "kind": "store" } ] }, { "title": "Promote", "nodes": [ { "id": "fsm2", "label": "State transition", "sub": "logged, immutable", "kind": "app" }, { "id": "serve", "label": "Serving plane", "sub": "available", "kind": "store" }, { "id": "evt", "label": "Available event", "kind": "queue" } ] }, { "title": "Read", "nodes": [ { "id": "readcred", "label": "Read credential", "sub": "state re-checked, 5 min", "kind": "security" }, { "id": "cdn", "label": "Edge delivery", "sub": "no pre-promotion caching", "kind": "integration" }, { "id": "reader", "label": "Another member", "kind": "actor" } ] } ], "edges": [ { "from": "cid", "to": "vd", "label": "verdict reuse on hash hit", "kind": "batch" }, { "from": "scan", "to": "gate", "label": "backlog sheds admission", "kind": "error" } ], "note": "The dotted path is the 35% that never reaches a scanner. The red path is the only arrow that runs backwards: saturation downstream is expressed as refusal at the front door.", "meta": { "v": "1.0", "dedup": "35% assumed hash hit rate" } }, { "id": "11-state-classes", "title": "Storage Classes — Ordered by What Loss Costs", "layout": "nested", "canvas": { "width": 1900 }, "boxes": [ { "title": "Class 1 — Precious: cannot be recomputed", "kind": "trust", "dir": "row", "children": [ { "title": "Object bytes", "kind": "boundary", "nodes": [ { "id": "b1", "label": "Available objects", "sub": "ZRS in region, GRS cross", "kind": "store" }, { "id": "b2", "label": "Quarantine evidence", "sub": "immutable, 180 d", "kind": "store" } ] }, { "title": "Record of why", "kind": "boundary", "nodes": [ { "id": "b3", "label": "Transition log", "sub": "append-only, 7 y, RPO 0", "kind": "store" }, { "id": "b4", "label": "Verdict store", "sub": "hash × engine ver, RPO 0", "kind": "store" } ] } ] }, { "title": "Class 2 — Rebuildable from Class 1", "kind": "boundary", "dir": "row", "children": [ { "title": "Projections", "kind": "lane", "nodes": [ { "id": "c1", "label": "Object metadata", "sub": "rebuild from log", "kind": "store" }, { "id": "c2", "label": "Dedup index", "sub": "rebuild from verdicts", "kind": "store" }, { "id": "c3", "label": "Quarantine queue view", "sub": "derived", "kind": "store" } ] } ] }, { "title": "Class 3 — Expendable: loss costs a retry", "kind": "lane", "dir": "row", "children": [ { "title": "In-flight and ephemeral", "kind": "plain", "nodes": [ { "id": "d1", "label": "Session chunk state", "sub": "RPO 60 s, one restart", "kind": "store" }, { "id": "d2", "label": "Scan work queue", "sub": "at-least-once, replayable", "kind": "queue" }, { "id": "d3", "label": "Edge cache", "sub": "revalidated, available only", "kind": "store" } ] } ] } ], "note": "Only Class 1 has an RPO worth arguing about. The design earns that by refusing to let any Class 2 store be authoritative for anything — which is also why a corrupt metadata partition is a rebuild rather than an incident.", "meta": { "v": "1.0", "rpo": "0 for class 1, 60 s for class 3" } }, { "id": "12-data-model", "title": "Data Model — Twelve Entities, and the Absent One", "layout": "er", "canvas": { "width": 1900, "cols": 4 }, "rowGap": 230, "entities": [ { "id": "tenant", "name": "tenant", "row": 0, "col": 0, "attrs": [ "tenant_id PK", "residency_region", "storage_quota_bytes", "reuse_isolation_level" ] }, { "id": "scope", "name": "destination_scope", "row": 0, "col": 1, "attrs": [ "scope_id PK", "tenant_id FK -> tenant", "size_ceiling_bytes", "allowed_types[]", "required_engines[]", "optimistic_allowed bool" ] }, { "id": "policyv", "name": "policy_version", "row": 0, "col": 2, "attrs": [ "policy_version_id PK", "scope_id FK -> scope", "effective_from", "composition_rule" ] }, { "id": "principal", "name": "principal", "row": 0, "col": 3, "kind": "security", "attrs": [ "principal_id PK", "type user | workload", "tenant_id FK -> tenant" ] }, { "id": "session", "name": "upload_session", "row": 1, "col": 1, "attrs": [ "session_id PK", "scope_id FK -> scope", "principal_id FK -> principal", "idempotency_key", "declared_length", "declared_type", "expires_at (+7 d)" ] }, { "id": "chunk", "name": "chunk", "row": 1, "col": 0, "attrs": [ "session_id FK -> upload_session", "block_index PK", "byte_length", "checksum", "stored_at" ] }, { "id": "object", "name": "object", "row": 1, "col": 2, "kind": "store", "attrs": [ "object_id PK", "scope_id FK -> scope", "content_id FK -> content", "policy_version_id FK", "lifecycle_state", "current_verdict_id FK", "filename (metadata only)" ] }, { "id": "content", "name": "content", "row": 1, "col": 3, "kind": "store", "attrs": [ "content_id PK (= hash)", "byte_length", "determined_type", "claimed_type", "first_seen_at" ] }, { "id": "verdict", "name": "verdict", "row": 2, "col": 3, "kind": "store", "attrs": [ "verdict_id PK", "content_id FK -> content", "engine_version_id FK", "outcome clean|infected|indeterminate", "detection_id", "bound_hit", "decided_at", "revoked_at null" ] }, { "id": "engine", "name": "engine_version", "row": 3, "col": 3, "attrs": [ "engine_version_id PK", "engine_name", "engine_build", "signature_set_version", "signature_published_at" ] }, { "id": "transition", "name": "transition", "row": 2, "col": 2, "kind": "store", "attrs": [ "transition_id PK", "object_id FK -> object", "from_state", "to_state", "actor_principal_id FK", "cause", "at (immutable)" ] }, { "id": "override", "name": "release_override", "row": 2, "col": 1, "kind": "security", "attrs": [ "override_id PK", "object_id FK -> object", "approver_principal_id FK", "reason (required)", "approved_at" ] } ], "relations": [ { "from": "tenant", "to": "scope", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "scope", "to": "policyv", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "scope", "to": "session", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "session", "to": "chunk", "label": "1 : N", "from_side": "w", "to_side": "e" }, { "from": "session", "to": "object", "label": "1 : 1", "from_side": "e", "to_side": "w" }, { "from": "content", "to": "object", "label": "1 : N", "from_side": "w", "to_side": "e" }, { "from": "content", "to": "verdict", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "engine", "to": "verdict", "label": "1 : N", "from_side": "n", "to_side": "s" }, { "from": "object", "to": "transition", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "object", "to": "override", "label": "1 : N", "from_side": "s1", "to_side": "n", "kind": "optional" } ], "note": "The absent entity is the one every first draft adds: a boolean is_clean on object. Cleanliness is a verdict with an engine, a signature version, a time and a revocation field — not a property of the object.", "meta": { "v": "1.0", "entities": "12" } }, { "id": "13-critical-flow-upload-to-verdict", "title": "Critical Flow — Initiate to First Read", "layout": "sequence", "canvas": { "width": 1900 }, "lifelines": [ { "id": "client", "label": "Client", "kind": "actor" }, { "id": "api", "label": "Upload API", "kind": "integration" }, { "id": "mint", "label": "Credential minting", "kind": "security" }, { "id": "blob", "label": "Untrusted plane", "kind": "store" }, { "id": "fsm", "label": "State machine", "kind": "app" }, { "id": "queue", "label": "Scan queue", "kind": "queue" }, { "id": "worker", "label": "Scan worker", "kind": "app" }, { "id": "serve", "label": "Serving plane", "kind": "store" } ], "messages": [ { "from": "client", "to": "api", "label": "POST /initiate size, type, scope, idempotency key", "kind": "call" }, { "from": "api", "to": "api", "label": "admission: ceiling, allow-list, quota, authz", "kind": "self" }, { "from": "api", "to": "mint", "label": "mint write-only SAS for one path", "kind": "call" }, { "from": "api", "to": "client", "label": "session id + SAS (60 min)", "kind": "return" }, { "from": "client", "to": "blob", "label": "PUT blocks ×N, 16 parallel, per-chunk checksum", "kind": "call" }, { "from": "client", "to": "api", "label": "GET /session which blocks landed?", "kind": "call" }, { "from": "client", "to": "api", "label": "POST /finalise block set + whole-object hash", "kind": "call" }, { "from": "api", "to": "api", "label": "assert set and hash — refuse to assemble a mismatch", "kind": "self" }, { "from": "api", "to": "fsm", "label": "finalised", "kind": "call" }, { "from": "fsm", "to": "queue", "label": "enqueue once, durably, lane = interactive", "kind": "async" }, { "from": "fsm", "to": "client", "label": "202 — state: scanning", "kind": "return" }, { "from": "queue", "to": "worker", "label": "lease, visibility = slowest permitted scan", "kind": "call" }, { "from": "worker", "to": "blob", "label": "read bytes (only read right it has)", "kind": "call" }, { "from": "worker", "to": "worker", "label": "bounded: timeout, memory, depth 12, 200× expansion", "kind": "self" }, { "from": "worker", "to": "fsm", "label": "verdict: clean, engine + signature version", "kind": "call" }, { "from": "fsm", "to": "serve", "label": "promote, log the transition", "kind": "call" }, { "from": "fsm", "to": "client", "label": "event: available", "kind": "async" }, { "from": "client", "to": "api", "label": "GET /download", "kind": "call" }, { "from": "api", "to": "fsm", "label": "state still available? authz still holds?", "kind": "call" }, { "from": "api", "to": "client", "label": "read-only SAS, 5 min", "kind": "return" }, { "from": "worker", "to": "fsm", "label": "alternate: bound hit -> indeterminate, never clean", "kind": "error" } ], "note": "Message 11 is the honest one: the client is told scanning, not success. Message 19 is the one most designs omit — state and authorisation are re-checked at every credential issuance, not once at upload.", "meta": { "v": "1.0", "messages": "21" } }, { "id": "14-scan-pipeline-by-class", "title": "Scan Pipeline — Three Object Classes, One Contract", "layout": "swimlane", "canvas": { "width": 1960 }, "laneHeaderWidth": 180, "stages": [ "Admit", "Fetch", "Unpack", "Inspect", "Compose", "Record" ], "lanes": [ { "title": "Small — ≤ 10 MB", "cells": [ [ { "label": "Interactive lane", "kind": "queue" } ], [ { "label": "Stream from blob", "kind": "store" } ], [ { "label": "None needed" } ], [ { "label": "Signature engine", "kind": "app" } ], [ { "label": "Single-engine rule", "kind": "decision" } ], [ { "label": "Verdict, p50 2 s", "kind": "store" } ] ] }, { "title": "Large — up to 50 GB", "cells": [ [ { "label": "Background lane", "kind": "queue" }, { "label": "Large exec profile", "kind": "platform" } ], [ { "label": "Assemble to scratch", "kind": "store" } ], [ { "label": "Container walk", "kind": "app" } ], [ { "label": "Signature engine", "kind": "app" }, { "label": "Deep engine on trigger", "kind": "app" } ], [ { "label": "N-of-M, safest wins", "kind": "decision" } ], [ { "label": "Verdict, p95 20 min", "kind": "store" } ] ] }, { "title": "Archive / container", "cells": [ [ { "label": "Lane by size", "kind": "queue" } ], [ { "label": "Assemble to scratch", "kind": "store" } ], [ { "label": "Expand: depth 12, 200×", "kind": "app" }, { "label": "Bound breach", "kind": "risk" } ], [ { "label": "Per-member scan", "kind": "app" } ], [ { "label": "Any member infected = infected", "kind": "decision" } ], [ { "label": "Indeterminate names the bound", "kind": "store" } ] ] }, { "title": "Dedup short-circuit", "cells": [ [ { "label": "Hash hit, 35%", "kind": "decision" } ], [], [], [], [ { "label": "Reuse within isolation level", "kind": "security" } ], [ { "label": "Reuse recorded against origin", "kind": "store" } ] ] }, { "title": "Poison path", "cells": [ [], [], [ { "label": "Engine crash or OOM", "kind": "risk" } ], [ { "label": "Retry ≤ 2, fresh sandbox", "kind": "app" } ], [ { "label": "Dead-letter", "kind": "risk" } ], [ { "label": "Indeterminate + human within 24 h", "kind": "decision" } ] ] } ], "note": "The blank cells are the statement: a deduplicated object is never fetched or unpacked, and the poison path never reaches a composition rule. Every class ends in the same place — a recorded verdict — which is what lets one state machine serve all of them.", "meta": { "v": "1.0", "classes": "3 + 2 paths" } }, { "id": "15-back-pressure", "title": "Back-Pressure — Which Promise Breaks, In What Order", "layout": "grid", "canvas": { "width": 1960 }, "laneHeaderWidth": 190, "columns": [ "Normal", "Elevated", "Saturated", "Critical" ], "rows": [ { "title": "Trigger (oldest unscanned)", "cells": [ [ { "label": "< 1× target", "kind": "opportunity" } ], [ { "label": "1–2× target", "kind": "decision" } ], [ { "label": "2–5× target", "kind": "decision" } ], [ { "label": "> 5× target", "kind": "risk" } ] ] }, { "title": "Interactive lane", "cells": [ [ { "label": "Admit, p95 8 s" } ], [ { "label": "Admit, unchanged" } ], [ { "label": "Admit, widened target published" } ], [ { "label": "Reject at initiate, retry hint", "kind": "risk" } ] ] }, { "title": "Background lane", "cells": [ [ { "label": "Admit, 5× target" } ], [ { "label": "Admit, target widened" } ], [ { "label": "Throttle per tenant" } ], [ { "label": "Reject at initiate", "kind": "risk" } ] ] }, { "title": "Bulk lane", "cells": [ [ { "label": "Admit, 24 h target" } ], [ { "label": "Reject new initiations", "kind": "risk" } ], [ { "label": "Rejected", "kind": "risk" } ], [ { "label": "Rejected", "kind": "risk" } ] ] }, { "title": "Never done", "cells": [ [ { "label": "Admit what cannot be scanned", "kind": "risk" } ], [ { "label": "Degrade to signature-only silently", "kind": "risk" } ], [ { "label": "Serve an unscanned object", "kind": "risk" } ], [ { "label": "Queue without bound", "kind": "risk" } ] ] }, { "title": "What stays true", "cells": [ [ { "label": "Bytes already accepted are kept", "kind": "opportunity" } ], [ { "label": "Verdict still recorded for every object", "kind": "opportunity" } ], [ { "label": "No object reaches a reader uncleared", "kind": "opportunity" } ], [ { "label": "Ingest of accepted sessions continues", "kind": "opportunity" } ] ] } ], "note": "Red is refusal, green is the invariant. The bottom two rows are the point of the view: the shedding order is published in advance, and the one promise never traded is that nothing reaches a reader without a verdict.", "meta": { "v": "1.0", "order": "bulk, then background, then interactive" } }, { "id": "16-download-path", "title": "Download Path — Four Checks Before Any Byte Moves", "layout": "flow", "canvas": { "width": 1900 }, "chain": true, "align": "middle", "stages": [ { "title": "Ask", "nodes": [ { "id": "reader", "label": "Reader", "kind": "actor" }, { "id": "dlapi", "label": "Download API", "sub": "p99 ≤ 80 ms", "kind": "integration" } ] }, { "title": "Check", "nodes": [ { "id": "authz", "label": "Authorise now", "sub": "not at upload time", "kind": "decision" }, { "id": "stchk", "label": "State = available?", "sub": "re-read, every call", "kind": "decision" }, { "id": "vchk", "label": "Verdict current?", "sub": "not revoked", "kind": "decision" } ] }, { "title": "Mint", "nodes": [ { "id": "rsas", "label": "Read-only SAS", "sub": "one object, 5 min", "kind": "security" }, { "id": "hdr", "label": "Disposition headers", "sub": "inline only if allow-listed", "kind": "app" } ] }, { "title": "Serve", "nodes": [ { "id": "fd2", "label": "Front Door", "sub": "available objects only", "kind": "integration" }, { "id": "serving2", "label": "Serving plane", "sub": "direct, no platform compute", "kind": "store" } ] }, { "title": "Revoke", "nodes": [ { "id": "rescan", "label": "Re-scan / new intel", "sub": "signature change", "kind": "app" }, { "id": "revoke", "label": "Verdict revoked", "sub": "state -> quarantined", "kind": "decision" }, { "id": "purge", "label": "Demote + purge edge", "sub": "≤ 60 s", "kind": "app" } ] } ], "edges": [ { "from": "revoke", "to": "stchk", "kind": "error" }, { "from": "purge", "to": "fd2", "label": "cache invalidated", "kind": "async" } ], "note": "A revocation cannot recall a credential already issued, so the credential's 5-minute life is the real bound on exposure. That is why it is minutes and not hours, and why it is a requirement rather than a tuning choice.", "meta": { "v": "1.0", "exposure-bound": "5 min in-flight, 60 s to demote" } }, { "id": "17-deployment", "title": "Deployment — Two Regions Inside One Residency Boundary", "layout": "nested", "canvas": { "width": 1960 }, "boxes": [ { "title": "Residency boundary — tenant's declared geography", "kind": "trust", "dir": "col", "children": [ { "title": "Primary region — active", "kind": "cloud", "dir": "row", "children": [ { "title": "Zone-redundant control", "kind": "boundary", "nodes": [ { "id": "ca1", "label": "Control services", "sub": "Container Apps, 3 zones", "kind": "app" }, { "id": "cos1", "label": "Metadata", "sub": "Cosmos, strong, zone-redundant", "kind": "store" } ] }, { "title": "Scan capacity", "kind": "boundary", "nodes": [ { "id": "sj1", "label": "Interactive workers", "sub": "reserved", "kind": "app" }, { "id": "sj2", "label": "Bulk workers", "sub": "spot / interruptible", "kind": "app" } ] }, { "title": "Storage", "kind": "boundary", "nodes": [ { "id": "st1", "label": "Untrusted", "sub": "ZRS", "kind": "store" }, { "id": "st2", "label": "Serving", "sub": "ZRS + GRS", "kind": "store" } ] } ] }, { "title": "Secondary region — warm, same geography", "kind": "cloud", "dir": "row", "children": [ { "title": "Control, scaled to zero", "kind": "boundary", "nodes": [ { "id": "ca2", "label": "Control services", "sub": "RTO 15 min", "kind": "app" }, { "id": "cos2", "label": "Metadata replica", "sub": "≤ 60 s lag", "kind": "store" } ] }, { "title": "Scan, on demand", "kind": "boundary", "nodes": [ { "id": "sj3", "label": "Workers", "sub": "RTO 60 min", "kind": "app" } ] }, { "title": "Storage replica", "kind": "boundary", "nodes": [ { "id": "st3", "label": "Serving replica", "sub": "read-access GRS", "kind": "store" }, { "id": "vr", "label": "Verdict replica", "sub": "no re-scan on failover", "kind": "store" } ] } ] } ] }, { "title": "Other residency boundaries", "kind": "trust", "dir": "row", "children": [ { "title": "Independent stacks", "kind": "plain", "nodes": [ { "id": "geo2", "label": "Boundary B", "sub": "same shape, no arrow to A", "kind": "platform" }, { "id": "geo3", "label": "Boundary C", "sub": "same shape, no arrow to A", "kind": "platform" } ] } ] } ], "outside": [ { "id": "gfd", "label": "Front Door", "sub": "global, routes within boundary", "kind": "integration" }, { "id": "gentra", "label": "Entra ID", "sub": "global identity", "kind": "security" }, { "id": "gfeed", "label": "Signature feed", "sub": "pulled per boundary", "kind": "external" } ], "edges": [ { "from": "st2", "to": "st3", "label": "GRS, async", "kind": "async" }, { "from": "cos1", "to": "cos2", "label": "≤ 60 s", "kind": "async" } ], "note": "The absent arrow is the design: nothing replicates between residency boundaries, so a failover can never move an object's bytes out of the geography its tenant declared. Verdicts replicate with the bytes — a failover that re-scanned 12 PB would not be a failover.", "meta": { "v": "1.0", "rto": "15 min read path, 60 min scan" } }, { "id": "18-observability", "title": "Observability — Six Signals Across Six Stages, Four Alarms", "layout": "grid", "canvas": { "width": 2060 }, "laneHeaderWidth": 185, "columns": [ "Admit", "Transfer", "Finalise", "Scan", "Promote", "Serve" ], "rows": [ { "title": "Latency", "cells": [ [ { "label": "initiate p99" } ], [ { "label": "chunk ack p99" } ], [ { "label": "finalise p99" } ], [ { "label": "time-to-verdict by size band", "kind": "platform" } ], [ { "label": "promote duration" } ], [ { "label": "credential p99" } ] ] }, { "title": "Saturation", "cells": [ [ { "label": "admission rejects / lane" } ], [ { "label": "in-flight sessions" } ], [ { "label": "finalise backlog" } ], [ { "label": "ALARM: oldest unscanned / lane", "kind": "risk" } ], [ { "label": "promotion queue" } ], [ { "label": "edge origin fetches" } ] ] }, { "title": "Correctness", "cells": [ [ { "label": "claimed vs determined type" } ], [ { "label": "chunk checksum failures" } ], [ { "label": "hash mismatch refusals" } ], [ { "label": "indeterminate rate, bound hit" } ], [ { "label": "ALARM: stuck past dwell", "kind": "risk" } ], [ { "label": "ALARM: serve on non-available", "kind": "risk" } ] ] }, { "title": "Security", "cells": [ [ { "label": "authz denials" } ], [ { "label": "SAS misuse attempts" } ], [ { "label": "type-policy rejects" } ], [ { "label": "detections by engine" } ], [ { "label": "releases + overrides" } ], [ { "label": "break-glass reads" } ] ] }, { "title": "Freshness", "cells": [ [], [], [], [ { "label": "ALARM: signature set age", "kind": "risk" } ], [ { "label": "re-scan sweep progress" } ], [ { "label": "revocation propagation" } ] ] }, { "title": "Cost", "cells": [ [ { "label": "per-tenant initiations" } ], [ { "label": "ingress GB / tenant" } ], [ { "label": "dedup hit rate" } ], [ { "label": "scan cost / 1,000 objects" } ], [ { "label": "promotion copy bytes" } ], [ { "label": "egress GB / tenant" } ] ] } ], "note": "Four alarms wake a human. Everything else is a dashboard. Note what is not an alarm: queue depth. A deep queue that is draining is fine; a shallow queue whose oldest item is an hour old is not.", "meta": { "v": "1.0", "alarms": "4" } }, { "id": "19-object-lifecycle", "title": "Object Lifecycle — The Loop Most Designs Leave Open", "layout": "cycle", "canvas": { "width": 1620 }, "centre": { "label": "Lifecycle state", "sub": "sole gatekeeper" }, "nodes": [ { "id": "s1", "label": "Initiated", "sub": "credential issued" }, { "id": "s2", "label": "Transferring", "sub": "chunks landing" }, { "id": "s3", "label": "Finalised", "sub": "hash verified, unreachable", "kind": "decision" }, { "id": "s4", "label": "Scanning", "sub": "leased, bounded" }, { "id": "s5", "label": "Available", "sub": "serving plane", "kind": "opportunity" }, { "id": "s6", "label": "Quarantined", "sub": "evidence, 180 d", "kind": "risk" }, { "id": "s7", "label": "Re-judged", "sub": "new signature set", "kind": "app" } ], "ringLabels": [ "first chunk accepted", "finalise asserts the set", "enqueued once, durably", "clean verdict promotes", "infected or indeterminate", "release, or re-scan sweep", "revocation returns it" ], "rx": 470, "ry": 215, "note": "The closing arrow from Re-judged back to Initiated-side states is the one most implementations never draw: it is what makes a clean verdict revocable, and without it the liability window for new intelligence is unbounded.", "meta": { "v": "1.0", "states": "7 + deleted" } }, { "id": "20-security-zones", "title": "Security Zones — Where an Object Is Allowed to Be Dangerous", "layout": "zones", "canvas": { "width": 1960 }, "zones": [ { "title": "Internet — fully untrusted", "kind": "trust", "nodes": [ { "id": "z1a", "label": "Member device", "kind": "external" }, { "id": "z1b", "label": "Public form submitter", "kind": "external" }, { "id": "z1c", "label": "The uploaded bytes", "sub": "assumed hostile", "kind": "risk" } ] }, { "title": "Perimeter — authenticated, nothing stored", "kind": "trust", "nodes": [ { "id": "z2a", "label": "Front Door + WAF", "kind": "integration" }, { "id": "z2b", "label": "API gateway", "sub": "authn, quota", "kind": "integration" }, { "id": "z2c", "label": "Admission gate", "sub": "size, type, scope", "kind": "decision" } ] }, { "title": "Control plane — trusted, no bytes", "kind": "trust", "nodes": [ { "id": "z3a", "label": "Session & state services", "kind": "app" }, { "id": "z3b", "label": "Credential minting", "sub": "platform identity", "kind": "security" }, { "id": "z3c", "label": "Metadata & transition log", "kind": "store" } ] }, { "title": "Detonation zone — least trusted compute", "kind": "trust", "nodes": [ { "id": "z4a", "label": "Scan worker", "sub": "ephemeral, no inbound", "kind": "app" }, { "id": "z4b", "label": "Egress allow-list", "sub": "feed + verdict sink only", "kind": "security" }, { "id": "z4c", "label": "No state-change credential", "sub": "reads bytes, writes verdicts", "kind": "security" } ] }, { "title": "Untrusted data plane — deny by default", "kind": "trust", "nodes": [ { "id": "z5a", "label": "Unscanned container", "sub": "no issuable read SAS", "kind": "store" }, { "id": "z5b", "label": "Quarantine + evidence", "sub": "break-glass only", "kind": "store" } ] }, { "title": "Serving data plane — reachable", "kind": "trust", "nodes": [ { "id": "z6a", "label": "Available objects", "sub": "short read SAS", "kind": "store" }, { "id": "z6b", "label": "Edge cache", "sub": "available only", "kind": "store" } ] } ], "edges": [ { "from": "z1a", "to": "z2b", "label": "control: OAuth 2.0", "kind": "sync" }, { "from": "z2c", "to": "z3a", "label": "admitted session" }, { "from": "z3b", "to": "z5a", "label": "write-only SAS", "kind": "async" }, { "from": "z4a", "to": "z5a", "label": "read bytes", "kind": "sync" }, { "from": "z4a", "to": "z3c", "label": "verdict only", "kind": "async" }, { "from": "z3a", "to": "z6a", "label": "promote on clean", "kind": "async", "route": "tb" }, { "from": "z5b", "to": "z1c", "label": "never reachable", "kind": "error" } ], "note": "Two crossings carry the whole security argument: the client writes into the untrusted plane with a credential that cannot read, and the worker reads the untrusted plane with a credential that cannot change state. Neither side can both see the object and decide its fate.", "meta": { "v": "1.0", "zones": "6" } }, { "id": "21-identity-credential-flow", "title": "Identity & Credential Flow — Who Proves What, To Whom", "layout": "sequence", "canvas": { "width": 1860 }, "lifelines": [ { "id": "user", "label": "Member", "kind": "actor" }, { "id": "idp", "label": "Entra ID", "kind": "security" }, { "id": "api", "label": "Upload API", "kind": "integration" }, { "id": "pol", "label": "Policy resolver", "kind": "app" }, { "id": "mint", "label": "Credential minting", "kind": "security" }, { "id": "store", "label": "Blob storage", "kind": "store" }, { "id": "worker", "label": "Scan worker", "kind": "app" } ], "messages": [ { "from": "user", "to": "idp", "label": "sign in (product session)", "kind": "call" }, { "from": "idp", "to": "user", "label": "access token, scope + tenant claims", "kind": "return" }, { "from": "user", "to": "api", "label": "POST /initiate Bearer token", "kind": "call" }, { "from": "api", "to": "idp", "label": "validate token, resolve principal", "kind": "call" }, { "from": "api", "to": "pol", "label": "may this principal write this scope?", "kind": "call" }, { "from": "pol", "to": "api", "label": "yes — ceiling, types, engines, lane", "kind": "return" }, { "from": "api", "to": "mint", "label": "request write-only credential, one path", "kind": "call" }, { "from": "mint", "to": "idp", "label": "platform managed identity", "kind": "call" }, { "from": "mint", "to": "store", "label": "get user-delegation key", "kind": "call" }, { "from": "mint", "to": "api", "label": "SAS: write, one blob path, 60 min", "kind": "return" }, { "from": "api", "to": "user", "label": "credential — cannot read, cannot list, cannot delete", "kind": "return" }, { "from": "user", "to": "store", "label": "PUT blocks with SAS", "kind": "call" }, { "from": "worker", "to": "idp", "label": "workload identity, scan plane", "kind": "call" }, { "from": "worker", "to": "store", "label": "read untrusted plane only", "kind": "call" }, { "from": "worker", "to": "worker", "label": "no credential able to change state", "kind": "self" }, { "from": "user", "to": "api", "label": "GET /download", "kind": "call" }, { "from": "api", "to": "pol", "label": "read authz + current state + verdict", "kind": "call" }, { "from": "api", "to": "user", "label": "SAS: read, one blob path, 5 min", "kind": "return" }, { "from": "api", "to": "user", "label": "alternate: revoked -> refuse, state wins", "kind": "error" } ], "note": "No client ever holds a credential that spans more than one object or more than one verb, and no credential outlives the decision that justified it. The platform's own identity is the only thing the storage account trusts.", "meta": { "v": "1.0", "credential-ttl": "60 min write, 5 min read" } } ]