The security model, in one page

What Atria sees

Request metadata for the decision — the client certificate, the method and path, and, when a transaction ceiling applies to that agent, the JSON body it has to read a value out of. It runs inside your network, on your hardware.

What Atria keeps

The decision log, on the machine that made the decision. Newline-delimited JSON to a file or stdout, so it ships into whatever you already run and is retained under your policy, not ours.

What leaves your network

Nothing on the request path. Two things travel out of band and neither can block a call: the proxy pulls a revocation list from the CA, and it reports policy violations to the compliance ledger on a bounded, lossy queue that is dropped rather than allowed to apply backpressure.

What we can see

Not your traffic and not your logs. The CA knows which credentials it issued certificates to; the ledger sees violation reports, if you enable reporting.

Enrolment

An agent presents an API key issued to a named account and receives a short-lived certificate. No human step, no ticket — the boundary is the key, not the queue.

Certificate lifetime

15 minutes by default, 24 hours maximum. A compromised certificate is a problem measured in minutes; a compromised API key is revoked centrally.

Verification

Mutual TLS against a CA public key pinned into the proxy at install. No call to us, no shared secret, no JWT signing key to distribute or rotate across your fleet.

Behind a TLS-terminating edge

Where mTLS cannot reach the proxy — a CDN or load balancer terminates it first — the certificate and a signed proof of possession travel in a header instead, with a replay cache in front. Every request records which of the two modes made the decision, so one log is readable across a mixed fleet.

Revocation

Checked on every request against a list the proxy holds locally, at a cost that does not move between zero and ten thousand revoked certificates. The pull interval is configuration, not a constant we impose.

Route boundary

Method and path per agent, matched by segment rather than string prefix — /api/v1/orders does not admit /api/v1/orders-export. Subtrees are spelled explicitly with a trailing wildcard. Anything not granted is denied.

Rate boundary

Calls per minute per agent, counted after the other checks so a rejected request never spends the budget it was denied for.

Value boundary

An optional ceiling on the transaction value in the request body — the difference between "may call the payments endpoint" and "may move up to €10,000". It fails closed: a value sent as a string, under an aliased field name, or spread across a list of items is refused rather than waved through, each case verified against the proxy before the rule was tightened.

Destination boundary

One proxy can front several backends; a request names its target with a TA-Proxy-Pass header. The host is only forwarded to if it is in the certificate’s scope set — a list of host matchers fixed when the API key was issued, which no request field can widen — and in the proxy operator’s own allow-list. An agent holding a key scoped to one service has nowhere to ask for another.

Policy ownership

A YAML file you keep in your own repository and review in your own pull requests. There is no cloud policy push — this is the only policy source.

Policy changes

Reloaded through a local admin endpoint and swapped wholesale, so no request sees a half-applied document. A file that fails to parse leaves the previous policy in force and reports the error rather than opening the door.

One line per request

Allowed and denied alike. Append-only, newline-delimited JSON; existing records are never rewritten.

Fields

The agent id (the role), the API key id (the credential, which resolves to an account), the endpoint, the decision, the reason code behind it, the authentication mode, and whether the revocation list was current at that moment.

Why the denials matter

An allow-list produces its most useful evidence when it refuses. The reason code is what turns a 403 in a chart into "this agent tried an endpoint it was never granted, at 14:02, under this credential".

The CA is unreachable

The proxy keeps serving on the last revocation list it successfully pulled, and marks every audit line as stale until a pull succeeds. That is fail-open on revocation, chosen so a CA outage cannot take your API down with it — and made visible in the log rather than left silent, so the stale window is reconstructable afterwards. If that trade is wrong for your environment, it is the first thing to raise with us.

The policy file is broken

The previous policy stays in force and the reload fails loudly. A bad edit cannot widen access.

The compliance ledger is down

Violation reports queue, then drop. Agent traffic is never slowed or blocked by a reporting backlog; the local audit log remains the durable record.

The proxy itself is down

Nothing reaches the origin through it. Atria is in the path by design — run it the way you run any other component you cannot lose, and size the redundancy accordingly.

Transport

TLS 1.2 and 1.3 via rustls, mutual in both directions, with the client certificate verified against the pinned CA on every connection.

Certificates and signatures

ECDSA P-256 with SHA-256 throughout — the CA, every issued certificate, and the header-borne proof. The verifier accepts that one algorithm and no other, so a downgrade has nothing to negotiate.

Post-quantum

Not today, and we would rather say so than imply otherwise. Hybrid ML-KEM key agreement is a configuration change available to us now and is the half that matters first, because captured traffic can be decrypted later. Post-quantum certificate signatures wait on the upstream libraries to drop their "unstable" labels; when they do, the rollout is verifiers-first, because a proxy pinned at install upgrades on its own schedule and must never be handed a certificate it cannot validate.

Implementation

Rust, with no unsafe code anywhere in the workspace — 59 source files, zero blocks. Memory-safety bugs are the majority of CVEs in comparable C proxies, and this is the cheapest way to not have them.

• No SOC 2 or ISO 27001 certification. Both are in progress; we will not imply otherwise on a page like this.
• The audit log is append-only, not yet hash-chained. Tamper-evidence is Phase 2 — today the log is as tamper-evident as the host it sits on.
• gRPC is not supported. HTTP/1.1 and HTTP/2 are served, but the listener does not advertise h2 over ALPN yet, so gRPC clients will not connect.
• The admin endpoint (policy reload, revocation status) has no authentication of its own. Bind it to loopback or a management interface — the binary says the same thing at startup.
• No public status page, and no uptime commitment. There is nothing on the request path of ours to have uptime yet, which is the point, but we are not going to link a page that does not exist.
• Enterprise SSO (SAML/OIDC) for the back office is available on request, not self-serve. Hardware MFA is on the roadmap.

This list is maintained as things ship. If something you need is on it, that is a conversation worth having early — design partners move the order.

Send it through contact with the subject set to a technical question, or open an issue if it is not sensitive. We will acknowledge, agree a disclosure timeline with you, and credit you unless you would rather we did not. There is no bug bounty at this stage, and we would rather say that than let you find out after the work.