Separate transport from authority
Encrypted transport can protect a connection, but it does not decide whether an actor may perform an operation. Authentication, authorisation, revocation and auditing remain independent requirements.
- Cryptographic identity
- Authorised operations
- Evidence and revocation