// Technology / Field Updates
Update without reopening authority.
QHx signed resources provide a cryptographic path for policy and deployment changes in environments where operators should not make arbitrary modifications.
// Mechanism
Every update path is an authority path.
Fielded systems need change, but change must remain accountable. Signed resources let a trusted authority package resources, sign them, and apply them with rollback protection.
- SignBundle Kubernetes resources with a cryptographic signature.
- VersionUse monotonic resource versions to reject older signed states.
- SealProtect critical resources from ordinary modification where required.
- TransportCarry update bundles across disconnected or manually mediated paths without losing provenance.
The field can receive change without receiving unchecked control.