Secure APIs and workloads

High-risk API routes and workload-to-workload calls still authorize with reusable bearer tokens and shared service secrets. Keep the wire shape familiar; change the authority object to an envelope bound to method, endpoint, body hash, policy, tau, and a single-use nonce.

API: replace credentials

Route table showing bearer removed and proof required

How a Gate decides

Read the pipeline left-to-right: each Gate stage checks binding, freshness, and burn order before allow. Gold highlights burn-before-validate so replay dies at the ledger, not after crypto. Takeaway: enforcement order is part of the security claim, not a UX detail.

You do not need to rewrite every service to eliminate ambient credentials. Put Gate (the enforcement component: reverse proxy, SDK middleware, MCP wrapper, or sidecar) in front of the routes whose stolen tokens hurt most (admin, export, payment, mutate). Migrate with shadow mode first, then flip proof-required per endpoint when the reject stages match your expectations.

Clients that already speak JSON keep speaking JSON. They learn to present an envelope (a one-time cryptographic authorization for a single request, replacing the reusable bearer token or API key) instead of, or during coexistence in addition to, a bearer token. Replay of a captured payload fails at the nonce stage by design under Control's durable nonce ledger and burn-before-validate (the ledger records the nonce as spent before the cryptographic proof is checked).

For a sysadmin, this sits behind your existing reverse proxy, API gateway, service mesh, or WAF. Authentication (OIDC, SAML, mTLS) can stay. What changes is what you accept as authority for a state-changing call.

What this solution claims

Existing REST/JSON APIs can keep their shapes while replacing bearer authority with request-bound envelopes.ValidatedDEMO-HACK news poll is ordinary JSON; only the authority object changes.

Every envelope binds method, endpoint_id, request body hash, policy hash, tau, and nonce_uuid into one composite digest.Shippingrequest_hash = sha256(method || endpoint_id || request_body_hash || policy_hash || tau || nonce_uuid).Holds under the reference architecture

Authority expires at the end of the request (a captured envelope is a fossil, not a reusable credential).ShippingOne-shot nonce plus request binding; capture does not authorize a second call.Holds under the reference architecture

Machine-to-machine authorization

Workloads still call each other with shared service-account tokens that every pod can steal. Workload-to-workload calls should prove per-request authority with a circuit (a compiled cryptographic identity) rather than a shared API key in every pod.

Service meshes and mTLS tell you which workload spoke. They do not by themselves prove that this POST with this body may run once. Shared service account tokens collapse that distinction: steal one, call everything the token can reach.

ENI6MA issues circuits per service identity through Foundry (the minting appliance), enforces Gate on the callee, and burns nonces in Control before validation so captured traffic is not reusable authority. Revocation is handle deactivation in Control (one state change), not a secret rotation campaign across every replica.

Hybrid agent-mode circuits are available when machine callers need post-quantum key agreement without changing the envelope contract Gate enforces.

What this solution claims

Machine-to-machine calls can prove per-request authority without a shared long-lived service secret.ValidatedAgent-mode hybrid circuits mint envelopes bound to method, endpoint, and body hash.

Identity is compiled into the circuit binary (there is no vault of reusable secrets to steal).ShippingConfig, entropy, and policy travel with the artifact; the handle resolves to the active binary.Holds under the reference architecture

Revocation is one registry state change on the circuit handle, not a rotation campaign across every workload.ShippingDeactivating a handle stops new envelopes for that identity at the control plane.Holds under the reference architecture