No network-location trust
IP address and location can be context; neither is sufficient authority to access a resource.
SECURITY & TRUST MODEL
Trust is proven, bounded, and recorded.
Oten Access does not grant implicit trust because a user is on a particular network or a device belongs to the organization. Decisions combine identity, device evidence, resource context, policy, and session state, then record whether enforcement was actually applied.
System role: Security architecture and product assurance
QUALIFYSource · Freshness · IntegrityNo false green
DECIDEPolicy + Mandatory gatesVersioned
BOUNDScope + TTL + ConditionsRevocable
ENFORCEEndpoint + GatewayAcknowledged
RECOVERNew verified evidenceNot time-only
Security behavior is explicit at each trust boundary.
Two identities
User or workload identity and device identity are established and revoked independently.
Least privilege by resource
Policy scopes access to application, service, host, protocol, port, method, role, and time.
Bounded and revocable
Sessions, credentials, certificates, decisions, and connection leases have explicit lifetime and revoke semantics.
Signed desired state
Endpoint and Gateway validate immutable policy and configuration before activation.
Assume partial failure
Last-known-good, expiry, rollback, fail-open, fail-closed, and break-glass are explicit policy choices.
Audit decision and enforcement
The trail records policy version, target enforcement points, acknowledgements, failures, and recovery requirements, not only login.
Every identity and credential has a purpose, storage boundary, and revoke path.
User OIDC session
System-browser Authorization Code with PKCE, state and nonce validation, exact redirects, secure token storage, and separate local, IdP, and resource-session revoke semantics.
Device key or certificate
Binds an enrolled Agent Node; uses non-exportable hardware or platform storage only where support is verified; rotates or revokes independently from the user.
Setup Key
Bootstraps headless enrollment with one-time, TTL, usage, group, and audit constraints. It is not the long-term identity of the enrolled node.
WireGuard key
Authenticates encrypted data-plane peers under secure Agent storage and rotation policy; node removal updates authorized peer state.
Gateway node identity
Authenticates a data-plane node to Control Plane through mTLS or an equivalent mechanism, with rotation and explicit revoke.
Configuration signing key
Signs desired-state artifacts through a KMS or HSM boundary separated from the online serving role and supported by trust-bundle rotation.
JIT credential
A short-lived credential or certificate for scoped privileged authority with TTL, explicit revoke, and protocol-specific session termination.
Confidentiality does not replace configuration integrity.
- Use immutable policy and configuration versions with canonical bytes, digest, and signature.
- Bind artifacts to tenant, deployment, group, node audience, issue time, validity, and expiry.
- Prevent rollback through a monotonic sequence or equivalent trusted mechanism.
- Run schema, reference, compatibility, and security preflight before activation.
- Expose Staged → Active transitions, health confirmation, bounded last-known-good, and recoverable rollback.
- Audit actor, target, artifact version, node result, and rollback reason.
Continuous trust requires truthful evidence.
No false green
Process presence, test fixtures, mock data, stale signals, or an allocated interface cannot produce Verified, Protected, Connected, or Enforcing.
Evidence qualification
A trust signal identifies source, observation time, validity, policy generation, release, tenant and device binding, evidence digest, confidence, and reasons.
Mandatory gates
Revoked identity, invalid signature, expired authority, missing fail-closed guard, sensor quarantine, or critical verdict overrides a high Health Score.
Enforcement confirmation
The loop closes only when each required Policy Enforcement Point acknowledges the versioned action or reports failure.
Mode-specific revocation
Network flow, L7 request, WebSocket, SSH, database, Kubernetes, and PAM sessions have different revoke and termination semantics.
Evidence-based recovery
Restore requires new live evidence, resolved mandatory gates, hysteresis or approval, a new bounded decision, and confirmed enforcement.
Security evidence is governed by purpose and minimum necessary collection.
- Collect only the posture, telemetry, metadata, and content evidence required by policy.
- Separate product analytics from security evidence and never send identifiers, tokens, or user-entered sensitive text to analytics.
- Enforce tenant isolation across storage, cache, queue, indexing, and search boundaries.
- Use role-specific access to device detail, alert evidence, privileged-session recordings, and DLP incidents.
- Make retention, export, deletion, redaction, and legal governance explicit.
- Disclose Relay metadata and Gateway access-log scope without exposing protected infrastructure details.
Failure converges toward the configured restrictive state.
Critical resource + expired trust
Fail closed with a safe reason, last synchronization, expiry, request ID, and correlated audit.
Low-risk resource + short outage
Policy may permit bounded last-known-good behavior with a visible offline or grace state and expiry.
Unknown posture provider
Unknown or stale remains explicit and produces the configured policy outcome rather than an implicit pass.
Invalid configuration signature
Reject activation, preserve a valid last-known-good artifact or restrictive baseline, stop rollout, and raise a high-severity event.
Audit destination unavailable
Buffer within a defined limit, surface backpressure, and never silently lose evidence indefinitely.
Break-glass
Use explicit time-bound authority, strong authentication, immediate notification, enhanced audit, and post-event review.
Guardrails address identity, policy, data path, and operational threats.
Enrollment abuse
One-time or bounded Setup Keys, approval, organization binding, hardware evidence where supported, and operator separation.
Token or credential theft
PKCE, secure storage, rotation, revoke, device policy, short lifetime, and audience validation.
Configuration tampering or replay
Signature, audience binding, expiry, trusted sequence, preflight, and bounded last-known-good.
Signal or Relay compromise
Authenticated channels, replay protection, peer authentication, end-to-end encryption, metadata minimization, rate limits, and audit.
Gateway compromise or split brain
Node identity, least privilege, secret isolation, explicit Failover Set, compatibility, fencing, rotation, and quarantine.
Overbroad policy or telemetry poisoning
Default deny, resource scope, impact preview, dry run, source identity, schema validation, confidence, reasons, and response guardrails.
Standards alignment is not certification.
NIST SP 800-207
The architecture follows identity- and resource-focused Zero Trust principles and avoids network-location implicit trust.
OpenID Connect
Provides the identity layer for federation and native-client authentication.
RFC 7636 / PKCE
Reduces authorization-code interception risk for public native clients as one part of the full OIDC security profile.
WireGuard
Provides the encrypted overlay data plane; resource authorization remains an independent identity and policy decision.
FIPS 203 / ML-KEM
Provides a standardized primitive for hybrid cryptography design. FIPS validation and quantum-resistance claims remain separate assurance properties with their own scoped evidence.
Next in Oten Access
Continue the technical evaluation.
Build confidence from evidence, not implied trust.
Review the technical dependencies and evidence requirements for active revocation, platform assurance, Gateway HA, and hybrid cryptography.