The guard becomes a property of the data
Each field is sealed under its own boolean policy over clearance attributes. One artifact travels everywhere unchanged, and each recipient's key ring opens exactly the fields their attributes satisfy. A coalition cell gets the grid; brigade HQ also gets the source.
- For
- Coalition operations, intelligence release cells
- Replaces
- Manual retyping across domains
- Policy
- AND · OR · k-of-n over attributes
- Authority
- Customer-held
The real cross-domain solution today is a staff officer retyping a grid
Moving a target coordinate from a SECRET national feed to a coalition partner requires an accredited guard on the boundary. Those boxes cost crores, take years to accredit, become a chokepoint at the moment of crisis and concentrate risk.
Worse, they force a whole-document decision at the boundary, so the usual outcome is that the document is withheld and someone retypes one grid reference into a chat window. That person is slow, and makes mistakes.
Policy per field
Each field gets a fresh key, shared down its policy tree: OR replicates, AND splits by XOR, k-of-n uses Shamir.
Leaves sealed to attributes
Each leaf share is sealed under the key for its clearance attribute, issued by the customer's attribute authority.
One artifact
Every slot is padded to the same shape, so the artifact reveals nothing about which fields exist.
Each reader opens their share
A reader's key ring opens exactly the fields their attributes satisfy: redacted fields show as redacted; invisible fields do not show at all.
Technical summary
| Policy language | AND, OR and k-of-n over clearance attributes ("any two of BDE COMD, BDE 2IC, duty officer") |
|---|---|
| Construction | Symmetric linear-secret-sharing realisation of a CP-ABE access structure |
| Visibility | Redacted or invisible, per field |
| Artifact | Fixed-shape slots; identical bytes for every reader |
| Authority | Single national attribute authority, customer-held |
| Status | Policy tree real · tested |
The limits, stated plainly
- Whoever seals to a policy holds that policy's attribute keys, so sealing devices need the same custody discipline as Sigilcore.
- Collusion resistance has to come from binding attribute keys to their principal at issue, not from pairing-based algebra.
- For genuine multi-authority coalition federation this is the wrong construction; a pairing-based scheme belongs there.
- A partner who cannot open a field still holds its ciphertext. For fields with a long secrecy horizon, policy may require partner copies to omit them.
- Accreditors will ask what replaces a guard's content inspection and one-way flow control. That conversation belongs in the pilot.
The binding constraint is a signals regiment willing to run a trial.
Not capital. If you can open that door, or want the architecture note and the runnable prototype to take apart yourself, we would like to hear from you.