TC-17 Network protection, segmentation and isolation
| Objective | TC-17 |
| Evidence level | Evidence, Integrate |
| Domain | Security and risk fit |
| Owner | Raidiam for the platform and the demonstration estate. CBA and ID Partners for the Formal Proof of Concept network design. |
| Phase | Formal Proof of Concept |
| Proven by | content-network-architecture |
On what is claimed here. Where this document describes the demonstration, it states what the Enhanced Vendor Demo of 24 August 2026 is built to prove, not what has already been built, recorded or verified. Status for every scene is tracked in objectives/tc-objectives.yaml.
1. What CBA asked for
Network protection, segmentation and isolation for the PoC deployment pattern.
2. The strongest isolation statement available for the demonstration
The Enhanced Vendor Demo has no network path to CBA and no network path from CBA, beyond a browser fetching a public page. It is vendor hosted, holds synthetic data only, integrates with no CBA system, uses no CBA credentials and carries no contract dependency. There is nothing to segment from CBA because nothing is connected to CBA.
That is worth saying before any control list, because it answers the question a network reviewer is actually asking, which is what the exposure is, not which firewall product is in use.
3. Segmentation within the demonstration estate
| Boundary | Position |
|---|---|
| Administrative plane and runtime plane | The Trust Controller's administrative interface is separate from the runtime federation endpoints, and administrative access is authenticated (TC-14). |
| Between reference components | Each reference authorization server and each resource server is a separate deployment with its own configuration and its own credentials. A compromise of one does not carry to another through shared state. |
| Resource servers | Accept presented tokens and nothing else. They hold no administrative interface. |
| Demonstration estate and the Raidiam Connect platform | The demonstration components are consumers of the platform's public federation endpoints. They hold no privileged path into it beyond the pipeline credential described in content-access-controls.md. |
| Transport | TLS on every endpoint, with fixed hostnames under *.cba.raidiam.io established before any directory record or recording was made. |
4. Publication endpoints are public on purpose
Federation endpoints, meaning entity configurations, subordinate statements, the resolve endpoint, trust marks and trust mark status, are served over the public internet without authentication. A network reviewer should read that as a deliberate design position rather than an oversight, for three reasons:
- A federation whose statements cannot be fetched is not a federation. The value of the model is that any consumer, including ones CBA has not met, can verify an agent without asking CBA for a credential first.
- The control is the signature, not the transport. Every statement is signed and its chain terminates at a trust anchor CBA controls. A consumer verifies rather than trusts, so intercepting or replaying the transport gains an attacker nothing they could not obtain by fetching the same public document.
- The endpoints are read only. They expose no write path, no query interface into private data, and no administrative function.
What is published is public trust metadata by design. The classification is set out in content-data-protection.md.
5. The Formal Proof of Concept network pattern
Not built. The pattern depends on which deployment option CBA selects (content-deployment-model.md).
Option A, managed service. CBA's authorization servers and bridge components make outbound HTTPS calls to the federation endpoints. There is no inbound path into CBA. Security event delivery is either pushed to a CBA endpoint that CBA exposes and controls, or polled by CBA, whichever CBA's standards prefer. The polling variant requires no inbound path at all.
Option B, bring your own Postgres. The database sits in a CBA AWS account and VPC. Raidiam's processing layer reaches it over VPC peering or a site to site VPN, on private addressing, never over the public internet. The database is not publicly reachable. CBA controls the security groups, the network access control lists, the encryption at rest and the backups.
Controls that belong on that link, and should be agreed rather than assumed: least privilege security groups restricted to the specific ports and source ranges required, no public subnet placement for the database, encryption in transit on the database connection in addition to the tunnel, flow logging on both sides, and a named owner for the peering or VPN on each side.
6. Questions for CBA and ID Partners
- Which deployment option, and therefore which of the two patterns in section 5.
- If option B: which AWS account and VPC, peering or VPN, address ranges, and who owns each side.
- Whether outbound HTTPS from a CBA authorization server to a public federation endpoint is permitted under current network standards, and if not, what the approved pattern is. This is the single question most likely to become the critical path, because the answer may require a proxy or an egress allowlist with its own change process.
- Whether the federation endpoints must be reached through a CBA egress proxy, and whether that proxy performs TLS inspection. If it does, the effect on signature verification is nil, since verification is at the payload rather than the transport, but the proxy's own certificate handling and timeout behaviour need checking.
- Whether the administrative interface must be restricted to CBA network sources in addition to being authenticated.
- Whether security event delivery is push or pull, and if push, which CBA endpoint receives it.
- DNS: whether CBA requires any federation hostname to be resolvable or routable differently inside the CBA network.
7. Status
The demonstration estate's network position is as described in sections 2 to 4 and is proportionate to an isolated, synthetic, vendor hosted environment. The Formal Proof of Concept network design is not built, depends on the deployment option, and is jointly owned by CBA and ID Partners with Raidiam supplying the endpoint and connectivity requirements.