Trusted-Edge Admission

Admission boundaryThe browser makes the request. The trusted edge makes the risk claim.

Proof

Short-lived Ed25519 attestation bound to the exact request

Replay

Atomic nonce use; exact authenticated retries converge

Privacy

Coarse receipts only—no fingerprint data in model context

Ductor can require an Ed25519 attestation before accepting AI-chat work. It carries bounded risk signals that a browser must not author. The feature is off by default and is not a general metadata channel.

Trust contract

The edge authenticates the browser independently, strips client copies of reserved metadata, and signs a JWT with typ=ductor-edge+jwt and alg=EdDSA. Ductor verifies the exact issuer, key id, audience, subject, tenant, environment, session, request digest, issued/expiry times, schema, and one-time nonce.

The canonical request hash binds the uppercase method, operation, and normalized I-JSON body. Object order and insignificant whitespace do not matter; duplicate keys, multiple values, non-I-JSON numbers, changed arrays, or body swaps fail closed.

Supported admission operations are:

• aichat.turn.admit;
• aichat.input.respond;
• aichat.control.queue.

Admission pathEvery accepted write is bound before work begins

1. 01
   Observe

   The trusted edge evaluates bounded anti-abuse signals.

2. 02
   Bind

   Sign identity, scope, nonce, expiry, and canonical request digest.

3. 03
   Verify

   Ductor checks every claim and records first nonce use atomically.

4. 04
   Admit

   Persist a redacted receipt, then allow the authorized operation.

The attestation may contribute

Coarse bot, device, network-risk, and optional country-policy signals.

The attestation can never override

Identity, tenant, ACL, tool policy, consent, budget, or data residency.

Privacy boundary

The token cannot override identity, tenant, session ACL, tool policy, consent, or budget. Ductor persists a redacted receipt containing issuer/key/schema ids, hashes, replay disposition, coarse risk categories, and a country-policy boolean. It excludes the token, raw bot score, country, IP, ASN, JA4, and other fingerprint material from prompts, journals, logs, and traces.

The first issuer/nonce use is recorded atomically. An exact authenticated retry is accepted as the same admission; altered reuse is rejected. All replicas share the tenant's authoritative Postgres nonce store.

Rollout and rotation

Configure trusted_edge.enabled=true, required_for_aichat=true, the audience, environment, policy, and one or more issuer/key windows. Tokens must fit wholly inside the selected key window. Overlap old and new verification windows during rotation; only Ed25519 is accepted.

Start with a 30–60 second token lifetime in non-production. Enable production only after every public AI-chat write path crosses the signer. If the signer is unavailable, work admission fails closed; read, stream, cancellation, membership, lifecycle, and legal-hold routes keep their normal authorization contract.

Related