Programmable Messaging API  ·  View 21 of 22  ·  Assurance

Trust Zones

Five zones, and the boundary where a carrier's POST stops being hostile.

Editable source SVG draw.io All views
Internet — tenants and carriers Tenant application Carrier POST unverified until proven Forged receipt attempt Perimeter Cloud Armor and WAF Global load balancer mTLS optional Credential check scoped, revocable Carrier signature verify or allowlist + secret Application — stateless, workload identity only Submit and admission Attempt executors no long-lived secrets Ingest workers schema-bounded input Custody and session — the only place credentials live Credential custody per-route scope Cloud KMS tenant-managed keys Session pods pinned egress Data — encrypted, classified, residency-pinned Message ledger Bodies store-no-body supported Consent and audit append-only Break-glass body access time-bound, audited TLS, scoped credential verify before it is data tenant identity short-lived token bind material append Trust Zones — Nothing Trusted Comes From A Carrier External / third party Risk / gap Security / platform Interface / broker Application we own Data store synchronous An unverifiable carrier delivery is treated as hostile, not as data. That is the zone boundary that matters. v 1.0 · owner Integration Platform Architecture

Decisions

  • An unverifiable carrier delivery is treated as hostile rather than as data: the verification step is the zone boundary, not the firewall.
  • Carrier credentials live only in the custody and session zone, scoped per route, so one route's compromise is one route.
  • Store-no-body mode removes the content store entirely; the delivery record, receipts and consent are unaffected.

Assumptions

  • Workload identity everywhere internally; no static secrets between the attempt fleet and custody.
  • Break-glass body access is time-bounded, separately authorised and audited independently of tenant retention.

Risks

  • Routes whose carriers offer no signature scheme are protected only by source allowlisting and a shared secret, which is the weakest link in the ingest path.
◀  Route Lifecycle All views Identity And Authorisation  ▶
Solution Architecture v1.0 · Google Cloud · Integration Platform Architecture · 2026-10 · 22 views · 16 architecture decision records21-security-zones