Skip to main content

Stream hardening for classified & regulated work

The streaming surfaces in the overview are the query plane. This page covers what a classified or regulated deployment needs on top of them: a record that cannot be silently altered, a classification boundary enforced as events flow, and a controlled path for moving data between domains. These are the controls that make a live stream admissible evidence rather than a transient buffer.

In one paragraph​

Every stream record enters a hash-chained chain of custody with Merkle tamper detection; ingest is refused above the stream's classification level; a query is refused below the data's level; and a downward cross-domain transfer requires explicit authorization and is audited on every attempt.

The controls​

ControlWhat it enforces
Immutable audit streamAn append-only record of stream operations that cannot be edited in place.
Hash-chained chain of custodyA SHA-256 chain per record binding operation, entity, cell, timestamp, content hash, and the previous hash, so a removed or altered record breaks the chain.
Merkle tamper detectionA Merkle tree over records with inclusion proofs, so a single record's presence and integrity can be proven without revealing the rest.
Field-level cryptoEncryption applied at the field level within a record, not only to the record as a whole.
Classification guardOn ingest, the event's level must be ≤ the namespace level; on query, the caller's clearance must be ≥ the data's level.
Cross-domain guardUpward transfers are allowed; a downward transfer requires explicit authorization, and every attempt is audited: permitted or refused.
Compliance filterA filter on the streaming path that applies the regulated-estate policy before a record is served.

How a record is bound and guarded​

A record is guarded twice: once on the way in, where its classification is checked against the stream and its content is chained, and once on the way out, where the caller's clearance is checked and a cross-domain move is gated.

*Figure: two guards and a chain. On ingest the classification guard refuses a record above the namespace level; an accepted record is bound into a SHA-256 chain of custody and a Merkle tree with inclusion proofs. On read, the classification guard refuses a caller whose clearance is below the data level, and the cross-domain guard sends any downward transfer through explicit, audited authorization. Every refusal is recorded.

Table equivalent

PathGuardOutcome on failure
IngestClassification guard (level ≤ namespace)Refused, recorded
Ingest (accepted)Chain of custody + MerkleRecord bound; tamper later detectable
QueryClassification guard (clearance ≥ level)Refused, recorded
Transfer (downward)Cross-domain guardRequires explicit authorization; every attempt audited
ServeCompliance filterRegulated policy applied before the record is returned

Why it is different​

  • The record proves its own integrity. A hash chain plus Merkle inclusion proofs means a verifier can show a record is present and unaltered without trusting the operator, the same discipline the platform applies to its tamper-evident audit.
  • The classification boundary is on the stream, not around it. Ingest and query are checked against the classification ladder as events flow, so a stream cannot become a side door around the data's level.
  • A downward move is an owned act. Cross-domain transfer is not a config toggle; it is an authorized, audited event, which is exactly what a cross-domain solution review asks for.

Across the deployment matrix​

  • Single-cell, the chain of custody is per-cell and complete for that cell's streams.
  • Multi-cell, each cell keeps its own tamper-evident chain; the cell field in each record identifies where it originated.
  • Sovereign / air-gapped, every control evaluates locally with no external service in the path; the guards do not weaken when the link is gone.
  • Cloud-enabled, the same controls apply to cloud-sourced streams registered as connections.