Security
Coexistence with PKI
PKI stays. mTLS stays. ENI6MA layers on top as request-level authorization, replacing the credentials that authorize requests, not the certificate hierarchy that authenticates peers.
Replaces the part of PKI that keeps breaching you (the credentials that authorize requests).
PKI and tokens prove who may speak for a while. ENI6MA envelopes prove that this message may change the world once.
Related: Security architecture · Reference architecture · Replace or augment PKI
What stays
- Certificate hierarchies and mTLS. Peer authentication and transport identity remain PKI's job.
- Existing identity providers. ENI6MA authorizes the request; it does not replace your IdP for human login flows unless you choose Pass+ for that path.
- Network segmentation and WAF. Gate sits at the request boundary; perimeter controls continue to apply.
What ENI6MA takes over
Request-level authorization: the part of PKI and token estates that keeps breaching you when a reusable credential is stolen. One-shot envelopes replace ambient API keys and bearer tokens on protected routes.
Certificates prove who may speak for a while. Envelopes prove that this message may change the world once.
Four-stage migration
Move endpoint by endpoint. No big-bang cutover required.
Inventory
Catalog ambient credentials on high-risk endpoints: API keys, bearer tokens, long-lived service certificates used as authorization.
Shadow mode
Deploy Gate to mint and validate envelopes alongside existing auth. Log accept/reject without enforcing fail-closed.
Proof-required on high-risk
Flip high-risk routes to require a valid envelope. Keep ambient credentials for break-glass under controlled policy.
Retire tokens per endpoint
Remove reusable credentials route by route once proof-required traffic is stable. Revocation becomes a registry state change.
Integration detail and shadow-mode configuration live under Developers → Migration.
Next step
Read the requirements that earn absolute claims, or open a Gate evaluation on one high-risk route.