Architecture Explainer & Interactive Sandbox

Centrally Audited Auth & Cryptographic Context Proxy

In high-compliance enterprise environments, authentication must be absolute, auditable, and decoupled from raw downstream logic. The Governance Gateway acts as the central traffic cop: intercepting external user requests, authenticating them either corporate single sign-on (OIDC) or decentralized signatures (Web3 SIWE), resolving hierarchical entitlements, and packing them into an cryptographically signed downstream JWT context (X-Governance-Context) verified at downstream service boundaries. Play with the sandbox below to see the gateway in action.

1. Authentication Origin

Select the inbound identity provider representing the user's login method.

Corporate User Email

2. Governance Engine

The central gateway validates incoming signatures, retrieves tenant rules, and assembles the context.

Trust Proxy Gateway

Awaiting Inbound Request...

1 Inbound Token Decoded IDLE

2 Signature Cryptographically Validated IDLE

3 Tenant Feature & Entitlements Checked IDLE

4 X-Governance-Context Compiled & Signed IDLE

3. Secure Dispatch

Downstream microservices (e.g. CMS, Storefront) receive this signed context header.

Dispatched HTTP Request

GET /api/cms/content HTTP/1.1

Host: cms.gianteagle.delectableai.internal

Accept: application/json

X-Governance-Context: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...

{ "iss": "-governance-gateway", "sub": "smehta@gianteagle.com", "tenant_id": "gianteagle", "auth_method": "OIDC", "roles": ["admin", "compliance_officer"], "entitlements": ["_tenant_features", "rmn_campaigns", "abac_unfiltered_access"], "signature_verified": true, "exp": 1781512800 }

Awaiting proxy compilation...

Sovereign Context Profile

This data has been compiled directly into your cryptographically signed token context and is ready to stream into your personal endpoints.

Context Principal: smehta@gianteagle.com

Household GNN Group: G-9842 (Giant Eagle Shared Family Sub-Graph)

Smart Pantry Decay Index: Replenish Alert

🥛 Organic Whole Milk 10% Left (Decay Critical)

🌾 Gluten-Free Rolled Oats 90% Left

🥑 Organic Haas Avocados 0% Left (OutOfStock)

Propensity & Preference Models (ABAC Claims):

🌾 Gluten-Free Affinity Score 94%

🌿 Organic Diet Preference 88%

Mobile OS & Wearables Integration

Explicitly authorize physical telemetry and fitness activities sharing with Delectable AI to trigger real-time precision nutrition adaptations.

❤️ Apple Health Active physiological data

🏃‍♂️ Strava Run Cardio activity sync

Wearables API Telemetry Stream:

                Active Energy:
                LINK WAITING
              
                Blood Glucose:
                LINK WAITING
              
                Heart Rate:
                LINK WAITING
              
                Token Cryptography:
                UNINITIALIZED

📡

Mobile App Offline

Awaiting secure context dispatch to establish zero-cold-start shopper personalization.

                Device Context: Uninitialized
              

Technical Architecture

The Centralized Trust Gateway implements a fail-closed, zero-cold-start architecture that operates centrally at our governance boundary, serving as the secure traffic cop for downstream components (such as cms and api_router).

Instead of forcing every downstream service to individually implement complex federated identity rules, handle OIDC handshakes, or query databases for tenant settings, the central gateway abstracts everything into a standardized, lightning-fast cryptographic assertion pipeline.

Core Capabilities & Flows

Unified Identity Boundary: Converts both corporate identity assertions (OIDC JSON Web Tokens containing email/groups) and Web3 identities (cryptographic proofs Ethereum signatures) into a uniform secure principal format.
No Downstream DB Requests: Entitlements (_tenant_features) and user roles are compiled centrally in <5ms and appended to the JWT payload. Downstream services read these values directly from the signed context, eliminating roundtrip DB calls.
Fail-Closed Security: Decoupled services apply localized attribute-based access control (ABAC) filters using the Gateway's public key. If the JWT signature is invalid or missing, or if a required tenant feature claim is absent, the downstream service immediately rejects the request.

Implementation Guide

To integrate or audit this centralized architecture, understand the technical flows and programmatic details detailed below.

How a Downstream Service Verifies the Context

Downstream services use the Gateway's public RSA key to verify the X-Governance-Context header in every inbound HTTP call:

# Downstream Verification Filter (Python / FastAPI)
from jose import jwt

PUBLIC_KEY = """-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0G...
-----END PUBLIC KEY-----"""

def verify_governance_context(request_headers):
    token = request_headers.get("X-Governance-Context")
    if not token:
        raise HTTPException(status_code=401, detail="Context missing")
    try:
        # Decodes and validates signature, expiration, and claims
        payload = jwt.decode(token, PUBLIC_KEY, algorithms=["RS256"])
        return payload
    except Exception:
        raise HTTPException(status_code=403, detail="Signature invalid")
        

Sequence Diagram (JWT Proxy Handshake)

Sequence Diagram: Browser/Client --> Trust Proxy --> Identity Provider (Okta/MetaMask) [Validates SSO/SIWE Claims] Trust Proxy --> Database/Cache --> [Lookup Tenant Entitlements] [Signs context JWT with Gateway RSA Key] Trust Proxy --> Downstream Service --> [Decrypts & enforces RBAC/ABAC]

← Back to Foundation substrate