Public Verification — Saas
Reference architecture for implementing public verification in a saas deployment context. Includes trust boundaries, authorization flow, evidence flow, and deployment-specific considerations.
Architecture Overview
- Architecture ID
- public-verification-saas
- Status
- TESTED
- Deployment Context
- saas
- Intended Use
- Implement public verification as part of an enterprise trust infrastructure, providing authorization, evidence, and verification capabilities for AI system operations
Components
Titan Handshake (authentication), Titan Verify (evidence validation), Titan Sign (cryptographic signing), Titan Forge (inventory attestation), managed API gateway, tenant-scoped data stores
Trust Boundaries
Tenant isolation boundary, authorization-scope boundary, evidence-integrity boundary, and signing-authority boundary
Operational Flows
Authorization Flow
Client authenticates via Titan Handshake, receives scoped authorization token, presents token for each operation, authorization verified at each component boundary
Evidence Flow
Operations generate receipts, receipts collected into evidence packages, packages verified by Titan Verify, verified packages eligible for certification via Titan Sign
Signature Flow
Evidence packages submitted to Titan Sign, signature applied with tenant-scoped signing key, signed packages stored with verification metadata, public verification endpoint exposes certificate status
Tenant Boundary Behavior
Strict tenant isolation enforced at authorization layer. Each tenant operates within a scoped boundary. Cross-tenant operations are denied by default. Evidence packages are tenant-scoped and cannot reference cross-tenant data.
Vallum Responsibilities
Maintain authorization infrastructure, enforce tenant isolation at the authorization layer, generate and store evidence packages, provide verification endpoints, and maintain signing-key security
Failure Modes
Authentication failure (denied access), authorization scope violation (operation blocked), evidence integrity failure (package rejected), signature failure (certification denied), and verification endpoint unavailability (status unknown)
Deployment Limitations
Standard deployment limitations apply. Availability depends on infrastructure reliability. Performance scales with allocated resources.
Evidence Produced
Authorization receipts, operation evidence packages, and signed records specific to the public verification pattern in a saas context
Evidence NOT Produced
Infrastructure provisioning records, network configuration evidence, physical security documentation, and saas-specific platform logs
Your Responsibilities
Configure tenant policies, integrate with identity provider, implement application-level controls, and maintain monitoring of Vallum-generated events
Relevant Titan Components
Need an architecture review for your specific deployment?
Request the Deployment Specification