Who may open a front door

Abstract

A public front door is allowed only on a tagged project, only of an approved type, only where the central policy decides first, and only once its allow rule ships in code. Switch the constraint to dry run to see what enforcement would refuse before it refuses it.

Exposure is a decision recorded in code before it exists, never a side effect of a deployment.

Its figure in the paper: § III.A →

The inputs

What the workload asks to build

Its exposure tag

The organization's constraint

Who decides first on the nodes

Its allow rule

The outcome

serving

Through the approved path: tagged, the right type, decided by the central policy, with its rule in code.

The record · 0 receipts

verified · 0

Nothing has been decided yet.

Try to break it

A claim stands because the attacks on it were attempted and refused. Each one runs against the instrument's own rules. 0 of 3 attempted · 0 refused

Open a public door with no tag
Under an enforced constraint, build a public gateway on an untagged project.
Bring your own load balancer
Tag the project correctly, then build a load balancer that bypasses the edge.
Serve before the rule exists
Everything approved, but the allow rule is not written yet.

Setting up the instrument…

Declared limits

Product names are replaced by roles; the constraint and its modes are generic.
Generic and illustrative throughout: the behaviour is shown, the internals of the systems it is drawn from are not.

Instruments beside it in § III.A

Every attack in the laboratory, on one page: try to break all of it →

Everything you did in the laboratory, in one chain you can rewind: the notebook →