Solutions · By problem
Replace or augment PKI
Replaces the part of PKI that keeps breaching you (the credentials that authorize requests). Certificate hierarchies and mTLS can stay.
Fighting the entire certificate ecosystem is the wrong war. Channel identity (mTLS, device certs, document signatures) remains useful. The failure buyers have lived through is reusable request credentials, bearer tokens and service certificates used as capabilities, that work from anywhere until rotation catches up.
ENI6MA layers request-level authorization on top: envelopes prove that this message may change the world once. Coexistence is the default migration posture, see Security → Coexistence for the four-stage path.
What this solution claims
ENI6MA replaces the part of PKI that keeps breaching you (the credentials that authorize requests) while certificates and mTLS can stay.ValidatedTransport identity (mTLS/PKI) coexists with request-level envelope authorization.
An envelope minted for one endpoint_id cannot authorize a different route.ShippingThe gate recomputes digests against its own endpoint_id and policy constants, not the client’s self-description.Holds under the reference architecture