# Trusted-Edge Admission (/docs/ai/trusted-edge-admission)



<StoryFrame label="Admission boundary" title="The browser makes the request. The trusted edge makes the risk claim." accent="gold">
  <StoryFact label="Proof">
    Short-lived Ed25519 attestation bound to the exact request
  </StoryFact>

  <StoryFact label="Replay">
    Atomic nonce use; exact authenticated retries converge
  </StoryFact>

  <StoryFact label="Privacy">
    Coarse receipts only—no fingerprint data in model context
  </StoryFact>
</StoryFrame>

Ductor can require an Ed25519 attestation before accepting AI-chat work. It carries
bounded risk signals that a browser must not author. The feature is off by default
and is not a general metadata channel.

## Trust contract [#trust-contract]

The edge authenticates the browser independently, strips client copies of reserved
metadata, and signs a JWT with `typ=ductor-edge+jwt` and `alg=EdDSA`. Ductor verifies
the exact issuer, key id, audience, subject, tenant, environment, session, request
digest, issued/expiry times, schema, and one-time nonce.

The canonical request hash binds the uppercase method, operation, and normalized
I-JSON body. Object order and insignificant whitespace do not matter; duplicate keys,
multiple values, non-I-JSON numbers, changed arrays, or body swaps fail closed.

Supported admission operations are:

* `aichat.turn.admit`;
* `aichat.input.respond`;
* `aichat.control.queue`.

<ProcessRail label="Admission path" title="Every accepted write is bound before work begins">
  <ProcessStep label="01" title="Observe" tone="gold">
    The trusted edge evaluates bounded anti-abuse signals.
  </ProcessStep>

  <ProcessStep label="02" title="Bind">
    Sign identity, scope, nonce, expiry, and canonical request digest.
  </ProcessStep>

  <ProcessStep label="03" title="Verify">
    Ductor checks every claim and records first nonce use atomically.
  </ProcessStep>

  <ProcessStep label="04" title="Admit" tone="commit">
    Persist a redacted receipt, then allow the authorized operation.
  </ProcessStep>
</ProcessRail>

<BoundaryPanel label="Trusted-edge authority boundary">
  <Boundary title="The attestation may contribute">
    Coarse bot, device, network-risk, and optional country-policy signals.
  </Boundary>

  <Boundary title="The attestation can never override" tone="halt">
    Identity, tenant, ACL, tool policy, consent, budget, or data residency.
  </Boundary>
</BoundaryPanel>

## Privacy boundary [#privacy-boundary]

The token cannot override identity, tenant, session ACL, tool policy, consent, or
budget. Ductor persists a redacted receipt containing issuer/key/schema ids, hashes,
replay disposition, coarse risk categories, and a country-policy boolean. It excludes
the token, raw bot score, country, IP, ASN, JA4, and other fingerprint material from
prompts, journals, logs, and traces.

The first issuer/nonce use is recorded atomically. An exact authenticated retry is
accepted as the same admission; altered reuse is rejected. All replicas share the
tenant's authoritative Postgres nonce store.

## Rollout and rotation [#rollout-and-rotation]

Configure `trusted_edge.enabled=true`, `required_for_aichat=true`, the audience,
environment, policy, and one or more issuer/key windows. Tokens must fit wholly inside
the selected key window. Overlap old and new verification windows during rotation;
only Ed25519 is accepted.

Start with a 30–60 second token lifetime in non-production. Enable production only
after every public AI-chat write path crosses the signer. If the signer is unavailable,
work admission fails closed; read, stream, cancellation, membership, lifecycle, and
legal-hold routes keep their normal authorization contract.

<Callout type="warn" title="Network location is not trust">
  A trusted header or private proxy hop is insufficient. Direct, replayed, expired, wrong-issuer,
  wrong-tenant, wrong-session, and body-swapped attestations are denied before work admission.
</Callout>

## Related [#related]

<Cards>
  <Card title="Durable Chat Agent" href="/docs/ai/chat-agent">
    The work-admission routes protected by edge attestations.
  </Card>

  <Card title="Tenancy Isolation" href="/docs/auth/tenancy-isolation">
    Authenticated identity and tenant authority remain canonical.
  </Card>
</Cards>