Overview
The Authority Fabric — an operation contract in which no permitted operation completes unilaterally, and every outcome is portable evidence.
Sealing data to hardware answers where a key may be used. The Authority Fabric answers who may authorize its use, under what rules, and how anyone else can check that afterwards.
It is one contract with three halves:
- An operation is submitted, appraised against a compiled policy, and authorized by a quorum of independent seats. No single principal is ever sufficient.
- Every outcome — including a refusal — is a signed decision envelope, committed to an append-only transparency log before anything is released.
- Anyone can verify the envelope offline, from bytes alone, after every service that produced it has been shut down.
The design rule the whole surface obeys: the network layer is a transport and must refuse to be anything more. Policy is never evaluated in an HTTP handler. A handler is given bytes that are already a decision.
What "no unilateral authority" means here
The phrase is easy to overstate, so it is worth being exact. Authority is described by a profile, and the profiles do not all make the same promise:
| Profile | What is true | What is not claimed |
|---|---|---|
N-AUTH | No permitted operation completes unilaterally. Use of the key requires independent, request-bound authorizations. | The key is whole and non-exportable inside its module. This is not a "never whole" claim. |
N-WRAP | No plaintext key reaches the coordinator. | As above — a whole key exists inside the module. |
N-DPRF | The distributed logical root is never reconstructed. Each seat returns a partial evaluation, never its share. | — |
N-THRESHOLD | Specific to the named algorithm and provider. | Nothing beyond that algorithm. |
N-WITNESS | An evidence anchor: a witness co-signs what it saw. | A witness signature is not an execution share. |
N-SHARE-LEGACY | Compatibility only. Transient reconstruction may occur, and must be disclosed. | Any never-whole claim. |
Only N-DPRF and N-THRESHOLD support the sentence "the root is never whole."
The distinction is enforced in code, not only in prose: a profile cannot report
both supports_never_whole_root and whole_key_exists, and a test asserts it.
Human approval, workload attestation and a regulator's veto are predicates or authorizations — never cryptographic secret shares. Counting them toward a threshold would overstate it, so the quorum rule keeps them apart.
The pieces
Operations
Open a session, submit an operation, read the decision. Canonical CBOR on the wire, and a nullifier that makes replay a refusal rather than a second effect.
Decisions and refusals
A refusal is a first-class, signed, logged outcome with a stable code — and "we could not tell" is a third state that must never be reported as a denial.
Transparency
An RFC 6962 log, independent witnesses, and split-view detection. Commit precedes release: an envelope claiming completion without inclusion is malformed.
Offline verification
A verifier that holds no socket, no path and no clock — it can only check what you hand it, and it never answers with a boolean.
Integrations
Google Cloud EKM / AWS XKS shapes, a PKCS#11 provider, and an MCP gateway that puts agent tool calls under the same contract.
Vault API
The simpler conditional-release surface: time-locks and t-of-n quorums over REST, with a hash-chained audit trail.
Maturity
Be clear-eyed about what has been shown and where.
| Status | |
|---|---|
| Protocol, policy, quorum, transparency, verifier | Implemented, adversarially tested, in software |
| Composed end-to-end operation with a software seat | Demonstrated in software |
| A hardware security module as a seat | Not yet demonstrated. The seat boundary is a trait; an HSM is a plug-in behind it |
| Independent external cryptographic review | Not yet done |
Where a page below says a property is demonstrated, it means demonstrated in software against an adversarial test, not assured by external review.
Proofs
Every security property is a live, externally verifiable proof — attestation, in-VRAM consumption, post-quantum key transport, and a transparent STARK audit stream.
Operations
Submit an operation, receive a signed decision — canonical CBOR on the wire, a nullifier that makes replay a refusal, and no policy anywhere in the transport.