Products
Keep your IdP, RBAC, gateway, and apps. Replace the secret-matching layer on one route first. Pick a validation topology that matches latency, residency, and ops appetite — then escalate trust without re-onboarding the identity.
Topology A
The relying service fetches the verifier once, verifies the digest, caches under a digest-keyed path, and validates locally thereafter. Periodically recompute the cached digest; pair with a status-freshness policy so a byte-correct cache cannot authenticate a revoked binding.
Choose for high volume, edge latency, and air-gap tolerance after first pull.
Topology B
The service sends the challenge or proof with the pinned digest. A managed executor resolves, verifies, runs the circuit in a sandbox, burns the nonce, and returns a verdict with a signed receipt. Client envelope code stays the same; ops load moves to the host.
Choose when you will not execute third-party native code or need fast integration.
Topology C
The organization runs the same executor inside its boundary. Authority records resolve through internal mirrors or signed snapshots. Challenges, proofs, validations, and ledger records stay inside the enterprise. Air-gap is possible within an explicit maximum staleness.
Choose for regulated, residency, or sovereign estates that cannot depend on a third-party control plane.
Topology D
A merchant or partner who has never seen the subject resolves the published digest and status, requests a single metered validation, relays the challenge, and retains a signed independently verifiable receipt. No long-lived account relationship is required.
Choose for first-contact commerce, checkout, or entitlement checks. Billing scaffolding may be roadmap-honest where StatusBadge applies.
Start with one-shot metered validation for a new relationship, move to hosted validation as the relationship persists, and graduate to local cache when volume justifies it — all against the same pinned digest. Choose enterprise self-hosted when compliance requires execution inside your boundary.
Mechanism deep dive: How the tech works · Deployment models · Config stacks
