NIE Operations Console

Trust Anchor v2

Verified Security Posture

Each guarantee below maps to a vulnerability the Trust Anchor work closed. Items marked LIVE are read from this gateway in real time. Items marked PENDING are confirmed design properties whose live signal arrives with the posture endpoint. Hover or tap the marker on any item for what it closes.

🛡

NIE Trust Anchor

The operator control plane that proves NIE is itself protected by the guarantees NIE enforces.

Infrastructure

Live Gateway Status

Real-time health checks against the NIE Gateway deployed on Azure Container Apps. All calls are live HTTPS requests to the production endpoint.

⚙ System Components

NIE Gatewaychecking...

Engine Versionchecking...

Redis (Channel 2)checking...

Event Hubs (Channel 3)checking...

Azure RegionWest US 2

TLS1.3 (Azure Front Door)

🔗 Endpoint

https://nie.xsoccorp.com

Role Management

Define attestation-floor-enforced roles. Each role specifies the minimum hardware trust level and maximum session TTL. Roles are signed with the admin key and cannot be tampered.

🔐 Register New Role

Role ID iRole ID. Pick an existing role to view or re-register its policy, or choose Custom role to define a new one.

Attestation Floor iAttestation floor. Minimum hardware trust a device must prove before this role is granted. SoftwareMin is dev or guest, TpmHardware is a standard TPM-backed device, TpmRequired enforces TPM for privileged roles.

TTL (seconds) iTTL. Maximum lifetime of a session granted under this role before re-attestation is required.

Key iSplit-derived key. The role signing key is the XOR of a browser-generated share and a gateway-generated share, combined only on the server. The full key never exists in the browser and nothing is entered by hand.

📋 Registered Roles

Role ID	Floor	TTL	Status

User Enrollment

Enroll Users and Devices

Enroll users individually or in bulk. Each enrollment generates a cryptographic device-user pairing and a portal link. No password is created at any point. At scale, use CSV batch import or connect your existing IdP directory.

👤 Individual Enrollment

User ID

Device ID

Role

Location

📦 Batch Enrollment (CSV)

Upload a CSV with columns: user_id, device_id, role_id, location. Each row creates a cryptographic pairing and generates a portal link. Large directories import in minutes.

🔗 Directory Connectors

☁

Azure AD / Entra ID

SCIM 2.0 auto-sync. Import users, groups, and device registrations.

Available

🔒

Okta Directory

Import existing Okta users and groups. One-way migration. Okta becomes redundant.

Available

💼

Workday HR

Auto-provision on hire, auto-revoke on termination. HR-driven lifecycle.

Q3 2026

Connectors use SCIM 2.0 provisioning standard. NIE creates cryptographic pairings for each imported user. No passwords are migrated or created. The connector imports identity records; NIE generates the cryptographic bindings server-side.

👥 Enrolled Users

User	Device	Role	Location	Device FP	Portal Link	Status

Session Monitor

Live Attestation Monitor

Attestation happens on the user's device, not from this console. The user's device collects hardware entropy, derives a DSKAG session key inside the WASM sandbox, signs a sealed token, and sends it to the gateway. The server never constructs tokens. This panel monitors sessions as they are created from user devices in real time.

🔒 Send Portal Link to User

Select an enrolled user and open their portal. The user authenticates on their device via FIDO2 biometric + DSKAG in WASM. Their session appears below automatically.

Select User

📋 Active Sessions Polling every 3s

🔌

Waiting for user attestations...

When a user authenticates via their device portal, their session appears here in real time.

⚠ Architecture Note

The NIE server never constructs, holds, or generates tokens. DSKAG session key derivation executes exclusively inside the WASM sandbox on the user's device from three inputs: hardware platform seed (Web Crypto CSPRNG), biometric factor (FIDO2/WebAuthn), and session nonce. The sealed token crosses the WASM boundary. The server validates the mathematical proof. A breach of this server yields read-only access to validation logs. There is no credential database, no key vault, no token store to compromise.

Authorization

Resource Access Control

Test resource authorization using an active session handle. Every authorization call re-checks the revocation cache. If the device was revoked between attestation and authorization, the call fails immediately.

✅ Authorize Resource Access

Session

Resource ID

Revocation

Three-Channel Device Revocation

Revoke a device across all three channels simultaneously: in-process cache (instant), Redis persistence (channel 2), and Event Hubs fan-out to SIEM/SOC (channel 3). Propagates globally in under 30 seconds.

🚫 Revoke Device

Select User

Reason

Channel 1: In-process cache

Channel 2: Redis persistence

Channel 3: Event Hubs (SIEM/SOC)

Geofencing

Location-Bound Policy Enforcement

Define geographic zones that constrain where attestation is accepted. A device outside an authorized zone is denied regardless of valid credentials. The zone check is part of the attestation pipeline, not a separate policy layer.

🌎 Geofence Zones

No geofence zones configured

📍 Zone Policies

Zone	Radius	Roles Allowed	Floor Override	Status
No geofence zones configured

Providence Audit Trail

Immutable Event Log

Every identity event is recorded in the Providence hash-chained audit trail. Entries are append-only, externally anchored every 5 minutes, and cannot be cleared even with full cloud access. Cryptographic non-repudiation via DSKAG session key HMAC.

📜 Event Stream

Waiting for events...