Multiplayer Collaborative Canvas  ·  View 21 of 23  ·  Assurance

Security Trust Zones

Five zones, and the fact that an unauthenticated viewer gets inside the first two by design.

Editable source SVG draw.io All views
Internet Editor client Viewer by link no account Plugin host Edge Front Door + WAF Admission token + capability Quota & rate limits Application — private Session hosts Control plane grants, history Asset service Data — private endpoints Operation log tenant keys Metadata Checkpoints & assets CMK on enterprise Keys and evidence Key Vault HSM Audit log immutable, 7 years Break-glass approved, logged WSS + token bound capability private, fenced every access Security — Trust Zones and What Crosses Them External / third party Interface / broker Application we own Data store Security / platform Risk / gap synchronous event / async Operators have no routine content path: break-glass is a separate identity, approved per use, and its own access is a record in the audit log. v 1.0 · owner Platform Architecture · date 2026-10

Decisions

  • Authority is bound at the edge and enforced at the session: every operation is authorised server-side against the capability on the connection, never against what the client's UI allowed (ADR-14).
  • Link-shared viewers are first-class, unauthenticated callers. They are rate-limited, attributable and revocable immediately — the open surface is designed rather than tolerated.
  • Operators have no routine content path. Break-glass is a separate identity, approved per use, and its own access is an audit record (ADR-15).

Crossings worth naming

  • Internet → Edge: WSS with a short-lived token, renewed in-band so a connection never outlives its credential.
  • Application → Data: private endpoints only, with tenant-scoped keys and customer-managed keys on the enterprise tier.
  • Uploaded assets are hostile input: type-verified, size-capped, stripped of active content and location metadata, and scanned before any rendition is served.

Risks

  • A share link is a bearer credential. Revocation is immediate, but a link that has already been pasted into a public channel has already been shared — the platform can only make revocation fast, not retroactive.
◀  Release and Rollout All views Admission and Revocation  ▶
Solution Architecture v1.0 · Microsoft Azure · Platform Architecture · 2026-1021-security-trust-zones