Federated trust across operators
Credential validation across operators without a shared root CA. Each trust domain keeps its own authority, and federation must be explicitly declared.
// Lineage
Hyperscalers solved workload identity for their own data centers.
This design comes from Google, Facebook, and Netflix: give every workload its own cryptographic identity, and stop treating the network as the trust anchor. QHx inherits the design. It does not inherit the controlled environment those systems ran in.
001 · Prehistory
Identity was location.
Classical infrastructure secured links, segments, perimeters, and hosts. The implicit assumption was that traffic reaching a service through the right network path came from a trustworthy requester.
Distributed systems broke that. With thousands of independently scheduled workloads migrating across machines, availability zones, and orchestration substrates, "inside the network" stopped being a meaningful claim.
Security moved up the stack, toward application-layer mutual authentication grounded in workload identity rather than network position. Every system in this lineage starts there.
002 · LOAS and ALTS
Workload identity as a platform primitive.
LOAS, Google's early internal service-to-service authentication model, made the structural commitment first: secure service communication should be infrastructure, handled automatically rather than rebuilt in each application.
Services authenticated bidirectionally. Communication was encrypted. Neither required per-service implementation work.
ALTS, Application Layer Transport Security, formalized that intuition into a fully specified system.
- Workload identity as the principalIdentity bound to workloads and machines instead of hostnames or IP addresses.
- Automated certificate issuanceMachines and workloads receive credentials through a controlled CA hierarchy, close to startup time.
- Transparent enforcementMutual authentication and encryption across all RPCs, inherited by applications rather than implemented by them.
- Identity-based authorizationAccess decided from the authenticated peer identity rather than after the fact through network ACLs.
- Operational scaleSession resumption and rotation engineered for the reconnect storms that simultaneous credential rotation produces at scale.
These were not flaws. They fit the environment they were built for.
ALTS assumes Google-controlled hardware, Google-controlled schedulers, a single root of trust, a homogeneous substrate, and tightly coupled issuance infrastructure. Those assumptions become constraints when the environment changes.
003 · Operability at scale
Operational reality, not cryptographic theory.
Facebook's internal migration from Kerberos toward mutual TLS at datacenter scale named the engineering problem more directly than the cryptographic one.
Private keys are generated on the host and never transmitted. Certificates are short-lived, with centralized invalidation in place of CRL distribution. Issuance sits on the container startup critical path.
Session ticket keys are rotated to all nodes to enable resumption without full handshakes.
The hard work was reconnect storms during rotation, issuance reliability under load, debugging certificate failures at millions of endpoints, and graceful degradation when issuance was unavailable.
004 · The bootstrap problem
Secret distribution is an identity problem.
Most secret distribution systems answer the wrong question. They move the secret to the workload without establishing that the workload is what it claims to be.
If the host's identity is unverified, you have not solved secret distribution. You have assumed the conclusion.
Netflix's Metatron started from the opposite premise: network location is not a cryptographically verifiable assertion of identity, and any system that uses IP, hostname, or VLAN as its identity anchor inherits that fragility.
Grounding the bootstrap in verifiable platform evidence removes the circularity. Once a workload identity is established that way, it becomes reusable for issuance, communication, audit, and policy.
005 · The shared logic
Different forms, the same loop.
Across LOAS, ALTS, Facebook's service encryption, and Netflix's Metatron, the pattern is consistent. Identity enables issuance. Issuance enables identity-bound transport.
Transport enables auditable enforcement. Enforcement feeds back into how identity is designed.
Each system in this lineage is a specific instantiation of that loop, tuned to its operational context.
006 · Environmental mismatch
Military networks have no single operator and no guaranteed connectivity.
The hyperscaler systems were designed with precision for the environments that produced them. The problem is environmental mismatch, not design inadequacy.
What hyperscaler systems assume
- One operatorA single authority controls the hosts and schedulers.
- Homogeneous substrateConsistent hardware, runtime, and network stack across the fleet.
- One root of trustA single CA hierarchy and one trust model for the whole environment.
- Persistent connectivityHigh-bandwidth, low-latency reachability assumed throughout.
- One security boundaryEverything runs inside a single organization's trust and data boundary.
The reality QHx targets
- No single operatorSeveral organizations operate in one coalition or joint environment, and none owns all the hosts and schedulers.
- Mixed assurance hardwareTPM-equipped servers and bare embedded systems in the same deployment.
- Separate trust rootsDistinct PKI hierarchies that never chained to a common authority and still have to interoperate.
- Contested connectivityDisconnected, intermittent, low-bandwidth, or actively degraded.
- Multiple security domainsClassification levels stay on separate networks, and transfers between them are mediated by cross-domain solutions under releasability rules.
007 · The departure points
Not ALTS in a different cloud.
The departures are architectural, not cosmetic. These capabilities exist because the operating reality demands them. They are not incremental extensions of the prior art.
Hardware-rooted attestation with graceful fallback
Identity grounded in TPM or secure enclave evidence where available, with explicit assurance level tracking where it is not.
Post-quantum cryptographic path
Algorithm agility, including ML-DSA and ML-KEM, addressing harvest-now-decrypt-later threats against long-duration sensitive data.
Namespace-scoped cryptographic policy
Algorithm selection, key lifetimes, and releasability constraints enforced per namespace, domain, or coalition boundary rather than uniformly.
Transparent intermediation across substrates
Identity-bound transport for unmodified applications, extended beyond the hyperscaler monoculture into containers, VMs, bare metal, and edge.
Offline-verifiable provenance
Notarized receipts that remain auditable without live control-plane connectivity. Disconnected and contested operation requires it.
// Lineage
The lineage is the same. The operating reality is not.
The deepest claim in this tradition, that secure distributed systems require automatic, identity-bound, cryptographically verifiable communication, was true at Google scale in the mid-2000s. It remains true across a coalition edge deployment today.
The pattern is not unique to Google. It is an architectural truth each system in this lineage rediscovered. QHx carries it into the world the prior art was not designed for.
Inspect architecture →