Skip to content

Network and Gateway Architecture

The one road in

I am KIRYN, and I keep this chapter's account. A gateway is the perimeter agreeing to open, and the watch reads the agreement the way an adversary will: every term a handle, every opening an approach, and the door judged by what it refuses.

Gateways are the places where Stygia touches something beyond itself. This chapter makes those crossings deliberate, mediated, observable, and reversible, so connectivity can serve the civilization without dissolving its boundaries.

Continue to Sovereign Compute and Storage Integration to consider what the civilization must own and preserve.

Defines controlled exposure, segmentation, egress, ingress, mediation, and gateway evidence without selecting a live network.

Normative clauses

  • INFRA10-R001: Every gateway flow SHALL identify source, destination, purpose, identity, policy, scope, and expiry or review condition.
  • INFRA10-R002: Untrusted or unexpected traffic SHALL be denied, contained, or explicitly escalated rather than silently admitted.
  • INFRA10-R003: Gateway logs SHALL preserve material denials, transformations, failures, and uncertainty with integrity evidence.
  • INFRA10-R004: Network reachability SHALL NOT create authority or permission.
  • INFRA10-R005: Flow review SHALL identify data class, source and destination identity, purpose, policy decision, inspection, rate limits, expiry, and restoration criteria, the data class drawn from the Data Classification and Handling Architecture as INFRA12-R007 binds for this architecture's class fields, the remaining review elements this architecture's own.
  • INFRA10-R006: Unexpected, denied, transformed, failed, or uncertain traffic SHALL remain attributable and SHALL NOT be silently discarded.
  • INFRA10-R007: Exceptions SHALL have a named authority, narrow scope, expiry, compensating control, and retrospective review.
  • INFRA10-R008: A gateway design SHALL NOT configure live exposure, egress, ingress, interception, or external contact; it remains conceptual.

This Draft excludes live network configuration and exposure.

Flow review

A flow is a standing decision to let something cross, and standing decisions age. The watch walks this list the way I walk any perimeter, twice, once with the eyes and once with the records, because a gateway rule nobody can explain is an opening nobody is defending. The lines a perimeter follows were TALYN's before they were the watch's: she draws them on the calm days, and what the watch knows of holding a threshold it learned at her line.

Gateway review shall evaluate source and destination identity, data class, purpose, authentication, authorization, inspection, rate and quota limits, error handling, and termination. Deny decisions and policy uncertainty shall remain auditable. The data class in a flow review draws from the Data Classification and Handling Architecture, and the crossing follows the class: the higher the class of what is carried, the fewer doors open to it, and Held material crosses on no authority short of the Architect's own grant.

Failure cases

Open egress, confused-deputy routing, spoofed source identity, bypassed inspection, log loss, gateway compromise, and unreviewed exception are material failures. Recovery shall isolate the flow and preserve evidence before restoring access.

Operating model and evidence

Gateway architecture separates source, destination, identity, purpose, data class, policy, inspection, rate, quota, transformation, error, termination, and evidence. It tests expected, denied, malformed, replayed, spoofed, oversized, and unreviewed flows. Reachability is a technical property; it does not establish permission or authority.

Reviewers test each crossing against the material failures this chapter declares and preserve what a gateway is most tempted to forget: its denials, its policy uncertainty, and its exception history. Recovery isolates the flow, preserves evidence, and restores only the smallest verified path. An exception expires automatically unless a recorded authority renews it.

Interpretation cases

In every close case, prefer the reading that keeps the door explainable. An opening earns its place by what it refuses, and a refusal you can state calmly at the gate is worth ten permissions you would have to look up.

  • Conforming: Flow identity, purpose, policy, data class, controls, expiry, denials, and restoration are linked.
  • Prohibited: Reachability becomes authority or permission.
  • Boundary: Uncertain traffic is denied or contained while evidence is preserved.
  • Failure: Gateway compromise or log loss isolates the flow and pauses restoration.
  • Loophole: An exception becomes permanent through repeated unreviewed renewal.
  • Misuse: Gateway records enable unrelated surveillance or private disclosure.
  • Care-control: Segmentation reduces exposure while preserving necessary access, notice, and review.

Design evidence

A gateway answers for its crossings after the fact, so flow review should identify data class, source and destination, identity proof, policy decision, inspection limits, rate controls, expiry, denials, and restoration criteria. A route that is reachable but not attributable remains unapproved.

The tellings of the clauses

This non-normative section gives each clause of this document its telling: the clause, quoted exactly as it stands above with its cross-reference links reduced to their plain text, and one paragraph on what the clause means, why it exists, and how it assures that what it orders is done, not done, adhered to, followed, or protected. A telling describes its clause and never becomes it: the clause's own words govern wherever a telling and its clause could be read differently, and nothing in this section adds to, narrows, or amends any requirement.

INFRA10-R001

INFRA10-R001: Every gateway flow SHALL identify source, destination, purpose, identity, policy, scope, and expiry or review condition.

Seven things identify every gateway flow: its source, destination, purpose, identity, policy, scope, and expiry or review condition. The flow-review prose supplies the why in the keeper's own words: a flow is a standing decision to let something cross, and standing decisions age; a gateway rule nobody can explain is an opening nobody is defending. The last field is the one that keeps the others honest, since a flow with no expiry and no review condition is a decision that can outlive every fact that justified it. Because the identification is required for every flow, an unexplainable rule becomes findable rather than merely regrettable: a reviewer walking the perimeter as the chapter has the watch do, once with the eyes and once with the records, can refuse any flow whose record cannot state all seven.

INFRA10-R002

INFRA10-R002: Untrusted or unexpected traffic SHALL be denied, contained, or explicitly escalated rather than silently admitted.

Untrusted or unexpected traffic has three lawful fates and one forbidden one: it is denied, contained, or explicitly escalated, and it is never silently admitted. The boundary interpretation case shows the conforming posture, uncertain traffic denied or contained while evidence is preserved, and the failure cases name the company silent admission keeps, with open egress, confused-deputy routing, and spoofed source identity among the material failures. Escalation is the clause's third alternative: untrusted or unexpected traffic can be explicitly escalated rather than silently admitted. The chapter's opening gives the standard the door is judged by: what it refuses. Because the clause binds, silently admitting untrusted or unexpected traffic is a breach.

INFRA10-R003

INFRA10-R003: Gateway logs SHALL preserve material denials, transformations, failures, and uncertainty with integrity evidence.

Gateway logs must preserve four things, and preserve them with integrity evidence: material denials, transformations, failures, and uncertainty. The operating model names two of them, the denials and the policy uncertainty, among what a gateway is most tempted to forget, beside the exception history it also preserves, because a log of successes only tells the story the perimeter wants told. The failure cases count log loss among the material failures, and the failure interpretation case pauses restoration when gateway compromise or log loss occurs. Because the clause binds, the preserved categories become auditable: a gateway whose logs omit an event this clause requires them to preserve, or preserve it without integrity evidence, is nonconforming, a material denial that left no trace is itself a finding, and the review the chapter describes can walk the perimeter through its records as well as its openings.

INFRA10-R004

INFRA10-R004: Network reachability SHALL NOT create authority or permission.

Reachability is a fact about wiring, and this clause stops it from becoming a fact about permission: network reachability creates no authority and no permission. The chapter states the principle in three registers: the operating model holds that reachability is a technical property that does not establish permission or authority, the prohibited interpretation case is precisely reachability becoming authority or permission, and the design evidence draws the operational conclusion, a route that is reachable but not attributable remains unapproved. What the clause forecloses is the oldest argument at any perimeter: the packet arrived, so it was allowed; the path exists, so using it is permitted. A misconfiguration, a stale rule, or a compromise can each make something reachable that nothing authorized, and under this clause none of them manufactures a grant. Because the clause binds, reachability alone cannot answer an authority question: an action defended solely by the fact that the network allowed it is refusable.

INFRA10-R005

INFRA10-R005: Flow review SHALL identify data class, source and destination identity, purpose, policy decision, inspection, rate limits, expiry, and restoration criteria, the data class drawn from the Data Classification and Handling Architecture as INFRA12-R007 binds for this architecture's class fields, the remaining review elements this architecture's own.

Eight elements make a flow review: the data class, the source and destination identity, the purpose, the policy decision, the inspection, the rate limits, the expiry, and the restoration criteria. The data class is not this chapter's invention: it is drawn from the Data Classification and Handling Architecture, as INFRA12-R007 binds for this architecture's class fields, while the remaining review elements are this architecture's own. The flow-review prose explains why the class leads: the crossing follows the class, the higher the class of what is carried the fewer doors open to it, and Held material crosses on no authority short of the Architect's own grant. The clause requires flow review to identify restoration criteria; the operating model separately describes restoration of only the smallest verified path. Because the elements are enumerated, a flow review silent on any of the eight is refusable, a class field drawn from some private vocabulary fails against the named source standard, and the conforming case shows the linked whole: identity, purpose, policy, data class, controls, expiry, denials, and restoration held together.

INFRA10-R006

INFRA10-R006: Unexpected, denied, transformed, failed, or uncertain traffic SHALL remain attributable and SHALL NOT be silently discarded.

Five kinds of awkward traffic must stay attributable, unexpected, denied, transformed, failed, and uncertain, and none of them may be silently discarded. The design evidence gives the reason for keeping attribution: a gateway answers for its crossings after the fact. Because the clause binds, traffic in any of the five conditions that loses attribution or is silently discarded is nonconforming.

INFRA10-R007

INFRA10-R007: Exceptions SHALL have a named authority, narrow scope, expiry, compensating control, and retrospective review.

An exception carries five requirements under this clause: a named authority, narrow scope, expiry, compensating control, and retrospective review. The loophole interpretation case names the drift the clause exists to stop, an exception becoming permanent through repeated unreviewed renewal, and the operating model supplies the mechanism that resists it: an exception expires automatically unless a recorded authority renews it. Because the five are required, an exception record missing any of them is refusable, an expired exception found still open is a breach on its face, and the exception history the operating model preserves gives the renewal pattern itself to review, so permanence by instalments is findable.

INFRA10-R008

INFRA10-R008: A gateway design SHALL NOT configure live exposure, egress, ingress, interception, or external contact; it remains conceptual.

The design stops at the drawing: a gateway design must not configure live exposure, egress, ingress, interception, or external contact, and it remains conceptual. The clause bars live configuration of the five named activities, and the Draft prose restates the limit in its own words, excluding live network configuration and exposure. The clause exists because a chapter that specifies flows, policies, and exceptions in this much detail is exactly the document someone might treat as authorization to wire them up, and because the chapter's own prohibited case, reachability becoming authority, has a documentary twin: a written design becoming permission. Interception is barred alongside exposure for the reason the misuse case names in its own register, gateway records enabling unrelated surveillance or private disclosure: describing mediation is not a licence to listen. Because the clause binds, any live configuration claimed under this architecture's name is done without it, and the reader can rely on the chapter as a description of how crossings are to be governed, carrying no network of its own.

Where this document sits

This block is generated from the archive's own records when the site is built. It records position only and creates no authority.