Leaderboard & Counting Service  ·  View 19 of 21  ·  Assurance

Trust Zones

Five zones, and the two writes that cross the fewest of them.

Editable source SVG draw.io All views
Untrusted — the member's device Product client Client event signature app attestation key Perimeter Load balancer TLS termination Edge policy rate limit, bot score Token verification member = subject Semi-trusted — tenant-scoped services Counting API Query API Quarantine holds, never drops Trusted — processing and projections Aggregation Projection builder Counters & ranked views Restricted — evidence and results Control plane store Spanner, CMEK Closed standings immutable Audit & retraction log append-only Key management TLS, signed event admitted request suspect contribution via durable log write version read only seal at close hold decision Leaderboard & Counting Service — Trust Zones External / third party Security / platform Interface / broker Application we own Data store synchronous failure / alternate event / async A client may increase its own counter and nothing else. Nothing in the semi-trusted zone can write a closed standing, and nothing outside the restricted zone holds a signing key. v 1.0 · owner Platform Architecture · date 2026-10

Decisions

  • A client may increase its own counter and nothing else. Every other write authority lives in a zone the device cannot reach.
  • Nothing in the semi-trusted zone can write a closed standing. Sealing happens in the processing plane at season close, and the restricted zone is read-only to everything else.
  • Quarantine sits in the semi-trusted zone deliberately: it must be reachable by the request path to hold a contribution, and its decisions are written to an append-only log in the restricted zone.

Controls

  • Client events are signed with an app attestation key so a replayed or forged event is distinguishable from the product's own client.
  • Customer-managed encryption on the control plane store; standings retained beyond the operational horizon keep per-tenant key boundaries.
  • Leaderboards that expose activity level or location history are opt-in per tenant with member-level exclusion.

Risks

  • App attestation raises the cost of forgery; it does not eliminate it. The inflation detector is the control that assumes attestation has been defeated.
  • A compromised tenant service credential can write any counter that tenant owns, at any value within bounds. Bounds and rate limits are therefore a security control, not a hygiene one.
◀  Projection Lifecycle All views Who May Increase a Counter  ▶
Solution Architecture v1.0 · Google Cloud · Platform Architecture · 2026-1019-security-trust-zones