The idea
A security standard that lives in documents is a wish. This reference architecture is written so that every rule names the platform mechanism that enforces it: an organization policy constraint, an IAM condition, a firewall policy, an admission control. Where a rule cannot be prevented, the design says plainly that it is watched instead, and names what watches it.
The architecture is drawn as six control planes under every workload. They are not layers of a stack that workloads sit on top of; they are planes that every workload inherits at once. The workload platforms, serverless containers and Kubernetes, are not a seventh plane. They inherit all six and add gates of their own.
Governance
One place where rules are written, one way they are relaxed, and one record of every change.
Controls attach to the resource hierarchy as high as they can and are relaxed as low as they must. Every preventive rule is a constraint, tested in dry run before it is enforced on a published date; the older constraints that have no dry run are counted from the live inventory, proven in a sandbox folder, then enforced folder by folder. Resource Manager tags are what the controls read; labels are what people and reports read; the pipeline writes both and nobody types either. An exception is a dated tag on a project or on one resource, held as code, 90 days at most, with a compensating control named. A standing need is not an exception: it is an approved pattern, recorded in code and reviewed every year. A rollback always opens a dated exception, so that a reversal cannot quietly become the standing state.
Identity
Every person, pipeline and workload proves who it is with a short-lived credential and holds only the access its job needs.
There are four identity paths and no fifth. Workforce users federate through the identity provider into a workforce pool, and groups map to roles. Build jobs exchange an OIDC token with a per-project provider whose attribute condition pins one repository by numeric identity, with a protected ref in production. Deploy runs exchange a second token with a second provider pinned to one stack; read scope reaches a planner account, write scope reaches the deployer, and approval sits before every apply. Workloads that hold keys today get federation instead. The build identity cannot deploy and the deploy identity cannot build. Keys are retired in waves by disable, soak and delete, then creation and upload are blocked and expiry is set once. Standing administrator roles give way to just-in-time elevation, and in the hub-and-spoke estate to time-boxed membership of an emergency-change group that is empty by default, because a deny policy there overrides any grant.
Network
Environments cannot reach each other by accident, and every permitted path is one somebody designed.
Hubs are divided by environment and regulated scope, and workload networks attach as spokes with explicit export filters, so overlapping or sensitive ranges are never advertised by default. Firewall policy has three layers: absolute denies and the quarantine rule at the organization, separation between environments at the folder, and the workload's own rules in its spoke. Policy is evaluated before classic rules, with an explicit, logged deny-all, so classic and implied rules are never reached. Secure tags carry the portfolio tier, one portfolio in one environment, because a rule cannot require two tags: every allow names one target tag and one source tag or range. An established shared network is not left behind; it gets its own policy, written by one stack, and is fenced tier by tier before anything moves.
Edge
The internet reaches workloads only through a front door with a policy on it.
One sanctioned public path: a global external application load balancer with a web-application-firewall policy, one per project with customer-facing services. The organization's hierarchical policy carries deny lists, emergency rules and go-to-next rules and no allow, because an allow at that layer would skip every project policy. The project's policy carries the application's rules; every rule starts in preview at the lowest sensitivity. A front door comes to exist only through the approved pattern: a privileged exposure tag bound on merge with security approval, a module that builds the load balancer with its baseline policy, a plan policy that refuses an external backend without one, and a constraint that refuses an external forwarding rule in a project without the tag. The policy on the load balancer does nothing if the direct address still answers, so closure means 404 from the front end, never a 401 or 403. An outer third-party tier is optional and never a substitute, under five conditions: origin lock, origin authentication, true client address preserved, one owner, no duplicated tuning.
Data
What a person or service can read follows how the data is classified, not which project it happens to sit in.
Dataset grants go to groups, never to projects. One policy tag per column from a small taxonomy, the stricter classification winning; masked by default, raw only for named groups. Row-level security where rows differ in audience; authorized views in place of direct table grants. Customer-managed keys are required unless the project's data-class tag says otherwise, so an untagged project is treated as restricted. A service perimeter lists the restricted projects and runs in dry run before enforcement. The rollout order follows from six documented platform behaviours: readers are granted while access is still open, and then every data policy of the taxonomy is created in one run, so that readers lose detail and never access.
AI
Models are used only on approved paths, with approved models, and every production prompt and response is screened.
A landing zone: the managed AI platform is denied to every project outside it by service restriction. A model allow-list by model and action, and an endpoint deny list for regions. Keyless, separate identities for the model caller, the grounding sources and each tool, with a custom calling role because the predefined one can also create and tune. A screening floor the organization sets and one stack writes, raised by templates each application names; inspect-only in non-production with a published block date, inspect-and-block in production from the first call. Four use-case tiers, assist, grounded, customer-facing and agentic, decide the controls from a one-page intake. Agents get one narrow identity per tool, human confirmation for consequential actions that shows exactly what will happen, and a kill switch that removes the tool bindings.
The workload platforms
Every request to a serverless service passes two independent gates: the ingress setting, which is the network gate, and the invoker check, which is the identity gate. A service is compliant only when both match its caller pattern, and closing an existing service follows an order: build the path, move the callers, close the network, close the identity, lock, verify from outside. Clusters are private, with workload identity on every node pool, pod security at restricted, admission policy, default-deny network policy per namespace, images by digest and binary authorization in production. Only a gateway of the approved class builds the approved public load balancer; the type constraint refuses the rest even in a project that carries the exposure tag.
What ties the planes together
Every control goes through the same five steps: measure from the live inventory, test in dry run or sandbox, triage, enforce on a published date, verify with a proving test run from outside. A control closes on its proving test, not on the day its policy was written. The delivery standard is the same for every plane: one repository, one stack and one deployer per project and environment, policy at plan time, approval before apply, drift detection on every stack, no standing human write access. Whoever can change the pipeline holds the credential, so the pipeline is protected like production.
This is the applied layer of a larger design. The standard it belongs to has a catalog of seventy controls, each with its mechanism, proving test and proposed owner, and it was reviewed over four rounds by independent checkers against the rendered documents, with a regression check of the corrections by checkers who had not seen them made. Nothing here is a description of a particular organization's estate; it is the design, drawn at pattern level.