> ## Documentation Index
> Fetch the complete documentation index at: https://doc.blueapi.ir/llms.txt
> Use this file to discover all available pages before exploring further.

# EMEP Security Architecture: Trust Boundaries and Zones

> Trust boundaries, principals, secrets management, artifact signing hierarchy, and network zones for EMEP research, enterprise, and air-gap deployments.

EMEP security architecture partitions the platform into trust zones, defines principals, governs secrets, and enforces artifact signing. The signing hierarchy uses root, intermediate, and signing keys. Network zones separate research, enterprise, and air-gap environments. This page includes a trust-boundary flowchart.

## Trust Boundary Flowchart

```mermaid theme={null}
flowchart TB
    subgraph EXTERNAL
        USER[User]
        CI[CI Pipeline]
    end
    subgraph RESEARCH_ZONE
        API[API Server]
        SCHED[Scheduler]
        TRACK[Tracker Publisher]
    end
    subgraph ENTERPRISE_ZONE
        EAPI[Enterprise API]
        ESCHED[Enterprise Scheduler]
        ETRACK[Enterprise Tracker]
    end
    subgraph AIR_GAP_ZONE
        AAPI[Offline API]
        ASCHED[Offline Scheduler]
        ATRACK[Offline Tracker]
        HSM[HSM / Key Vault]
    end
    subgraph EXECUTION
        GW[GPU Workers]
        EW[Eval Workers]
        AW[Artifact Writer]
    end
    subgraph STORAGE
        AS[ArtifactStore]
        ET[ExperimentTracker]
    end
    USER -->|TLS mTLS| API
    CI -->|Service Account Token| API
    API -->|Internal mTLS| SCHED
    SCHED -->|Job Token| GW
    GW -->|Write Token| AS
    EAPI -->|Enterprise mTLS| ESCHED
    ESCHED -->|Signed Job Token| GW
    AAPI -->|Local Unix Socket| ASCHED
    ASCHED -->|HSM-backed Token| GW
    GW -->|Signed Artifact| AS
    AS -->|Verification| HSM
    HSM -->|Root Cert| AS
```

## Principals

| Principal         | Authentication           | Authorization Scope                                      |
| ----------------- | ------------------------ | -------------------------------------------------------- |
| Research User     | API key + OIDC           | Submit experiments, view results, download artifacts     |
| Enterprise User   | SAML 2.0 + MFA           | Submit experiments, deploy models, manage signing keys   |
| Offline Operator  | Hardware token + PIN     | Air-gap operations, key ceremony, manual artifact import |
| CI Pipeline       | Service account JWT      | Automated benchmark runs, regression gates               |
| GPU Worker        | X.509 worker certificate | Execute jobs, write artifacts, publish events            |
| Evaluation Worker | X.509 worker certificate | Run benchmarks, read datasets, write results             |

## Secrets Management

Secrets are tiered by sensitivity and deployment mode.

**Research zone:** HashiCorp Vault or cloud KMS. Automatic rotation every 90 days. API keys scoped to experiment-level access.

**Enterprise zone:** HSM-backed key storage. Manual rotation with audit trail. Signing keys require dual-control.

**Air-gap zone:** Offline HSM or hardware token. No network-based secret distribution. Key ceremony performed by two offline operators.

## Artifact Signing Key Hierarchy

```mermaid theme={null}
flowchart TB
    ROOT[Root Key: Offline, HSM]
    INT1[Intermediate Key: Enterprise HSM]
    INT2[Intermediate Key: Research KMS]
    SIGN1[Signing Key: CI Worker]
    SIGN2[Signing Key: GPU Worker]
    SIGN3[Signing Key: Offline Operator]
    ROOT --> INT1
    ROOT --> INT2
    INT1 --> SIGN1
    INT1 --> SIGN3
    INT2 --> SIGN2
    SIGN1 --> ART1[Signed Artifact]
    SIGN2 --> ART2[Signed Artifact]
    SIGN3 --> ART3[Signed Artifact]
```

**Root key:** Generated offline, never touches a network. Stored in tamper-evident HSM. Used only to sign intermediate keys.

**Intermediate keys:** One per zone (enterprise, research, offline). Stored in zone-appropriate HSM or KMS. Signed by root. Used to sign worker keys.

**Signing keys:** Per-worker or per-operator. Short-lived, rotated daily. Signed by intermediate. Used to sign artifacts at write time.

**Verification:** ArtifactStore verifies full chain on every read. Chain anchored to root certificate distributed out-of-band to air-gap deployments.

## Network Zones

**Research zone:** Internet-accessible. Models imported from public hubs. Results published to internal dashboards. Lowest trust boundary.

**Enterprise zone:** VPC or on-premise. No direct internet from workers. Proxy for model hub access with allowlist. SAML authentication.

**Air-gap zone:** No network interfaces. Physical media for model import and artifact export. All operations logged to write-once media. Highest trust boundary.

## Threat Model Summary

| Threat                        | Mitigation                                        |
| ----------------------------- | ------------------------------------------------- |
| Artifact tampering in transit | TLS 1.3 + mTLS + artifact signatures              |
| Malicious model import        | SHA-256 verification + sandboxed loader           |
| Worker compromise             | Short-lived signing keys + least-privilege scopes |
| Key exfiltration              | HSM non-exportable keys + dual-control for root   |
| Supply chain injection        | Dependency lockfiles + reproducible builds + SBOM |

## Traceability Footer

| Spec Reference                                           | Phase   |
| -------------------------------------------------------- | ------- |
| [Model Supply Chain](/security/model-supply-chain)       | Phase 2 |
| [Artifact Signing](/security/artifact-signing)           | Phase 2 |
| [Offline Security](/security/offline-security)           | Phase 3 |
| [Security Requirements](/security/security-requirements) | Phase 1 |