Security
Coexistence with PKI
PKI stays. mTLS stays. ENI6MA layers on top as request-level authorization, replacing the credentials that authorize requests, not the certificate hierarchy that authenticates peers. Certificates prove who may speak for a while; envelopes prove that this request may proceed once.
Replaces the part of PKI that keeps breaching you (the credentials that authorize requests).
PKI and tokens prove who may speak for a while. ENI6MA envelopes prove that this request may proceed once; the verifier observes allow or deny for that binding alone.
PKI coexistence
PKI remains for channel while ENI6MA owns request authorization
Related: Security architecture · Reference architecture · Replace or augment PKI
Optional topologies coexistence
ENI6MA succeeds when it respects sunk cost: keep the estate you paid for; replace the secret-matching seam.
- Replace authentication at the secret-matching seam; leave authorization, RBAC, and gateway path intact.
- Store subject identifier, pinned digest, authenticator location, and optional short session — not password hashes for that path.
- Path A (org handle) or Path B (authenticator URL) with XOR exclusion — reject both or neither.
- Choose validation topology (local / hosted / self-hosted / metered) without changing the user’s published digest.
- Observability keeps tracing requests; signed validation receipts become first-class audit artifacts.
What stays
- Certificate hierarchies and mTLS. Peer authentication and transport identity remain PKI's job.
- Existing identity providers. ENI6MA authorizes the request; it does not replace your IdP for human login flows unless you choose Pass+ for that path.
- Network segmentation and WAF. Gate sits at the request boundary; perimeter controls continue to apply.
What ENI6MA takes over
Request-level authorization: the part of PKI and token estates that keeps breaching you when a reusable credential is stolen. One-shot envelopes replace ambient API keys and bearer tokens on protected routes.
Certificates prove who may speak for a while. Envelopes prove that this request may proceed once; the verifier observes allow or deny for that binding alone.
Four-stage migration
Move endpoint by endpoint. No big-bang cutover required.
Migration in four steps
Inventory, shadow, proof-required, then retire migration steps
Inventory
Catalog ambient credentials on high-risk endpoints: API keys, bearer tokens, long-lived service certificates used as authorization rather than transport identity.
Shadow mode
Deploy Gate to mint and validate envelopes alongside existing auth. Log accept/reject without enforcing fail-closed so operators can compare outcomes before cutover.
Proof-required on high-risk
Flip high-risk routes to require a valid envelope. Keep ambient credentials for break-glass under controlled policy while burn-before-validate is live on the proof path.
Retire tokens per endpoint
Remove reusable credentials route by route once proof-required traffic is stable. Revocation becomes a Control registry state change instead of a fleet-wide rotation campaign.
Integration detail and shadow-mode configuration live under Developers → Migration.
Next step
Book a live demo to walk coexistence against your IdP and routes, or read the requirements that earn absolute claims.