Quarantine Release Workflow¶

Release process — instantiates Transitive Trust Boundary Hardening

Holds every incoming artifact in an untrusted staging zone and promotes it to trusted use only after the required checks pass — recording an exception whenever it is released without them.

An artifact that arrives through a trusted relationship is not trusted on arrival. Quarantine Release Workflow is the standing process that catches every inbound payload — a vendor update, a package, a data feed, a model file — in a staging zone with no production reach, and moves it across the admission boundary into trusted use only once the required checks have passed. Its defining move is that promotion is an explicit, default-deny event, not the absence of an objection: nothing flows from "received" to "trusted" by inertia. Where each of its siblings supplies one verdict about a payload, this workflow supplies the holding pen and the promotion gate that decides, on the strength of those verdicts, whether the payload is released — and it keeps a ledger of every case where something was let through with a risk still open.

Example¶

A water utility receives a firmware update for its field PLCs from the equipment vendor, delivered over the normal support channel. Rather than pushing it to the field, the utility's workflow drops it into a quarantine segment — an isolated network with no path to live controllers. There it waits while the standing checks run: the signature is verified, the binary is detonated in a test rig, its bill of materials is reviewed. Two checks come back green; the third flags an unverifiable third-party library. Because the update also closes an actively-exploited safety flaw, the change-control board promotes it anyway — but only through the workflow's exception path: the residual risk is logged, a compensating monitor is attached, and the exception is set to expire at the next maintenance window, forcing a re-review. The firmware reaches the field, but nothing about "the vendor is trusted" made that happen automatically — a recorded decision did.

How it works¶

The workflow is a default-deny state machine, not a checklist. Every inbound artifact enters one state — quarantined — from which the only exits are promoted or rejected, and the promoted transition requires an affirmative pass, never merely the absence of a failure. The staging zone is engineered so that a payload sitting in it cannot reach anything that matters, which is what makes it safe to hold something suspect while it is examined. The checks themselves belong to sibling mechanisms; the workflow's own contribution is the boundary, the state transitions, and the exception ledger that records any promotion made while a check is still unresolved.

Tuning parameters¶

Isolation depth — how thoroughly the staging zone is severed from production (network, credentials, data). Deeper isolation contains a hostile payload better but makes realistic testing harder.
Promotion quorum — how many checks, and whose sign-off, a release requires. Raising it lowers the odds of admitting a bad artifact but slows every good one.
Dwell / soak time — how long an artifact must sit before promotion. Longer dwell catches slow-burn and delayed-trigger payloads at the cost of update latency.
Exception authority and expiry — who may release over an open risk, and how soon the exception forces re-review. Loosen it for operational urgency; tighten it to stop exceptions becoming permanent.

When it helps, and when it misleads¶

Its strength is that it abolishes "trusted because it arrived through a trusted door": there is exactly one choke point, and everything passes through it under a default of no. It also gives urgency a governed outlet — the exception path — instead of an ungoverned bypass.

Its failure mode is degeneration into a rubber stamp: a quarantine whose gate always says yes, or whose "checks" are box-ticking, is pure ceremony — security theater that adds latency and no assurance.^[1] Two related traps are the staging zone that is not actually isolated (so a payload can act while "quarantined"), and the exception that never expires and quietly becomes the norm. The discipline that guards against all three is to wire real, blocking verdicts into the gate, verify the isolation adversarially, and audit the exception ledger so every residual-trust grant is time-boxed and revisited — never run the workflow backward to bless a release already shipped.

How it implements the components¶

quarantine_and_staging_zone — the workflow is the staging zone plus the rules for entering and leaving it: a reach-less holding area where an untrusted artifact can be examined safely.
payload_admission_boundary — it owns the single boundary the artifact must cross to become trusted, and enforces that crossing as an explicit, default-deny promotion.
residual_trust_exception_record — its exception ledger records every promotion made over an unresolved risk, with owner, compensating control, and expiry.

It does not produce the verdicts it gates on — origin and integrity evidence come from Provenance Attestation Check, and behavioural clearance from Sandboxed Payload Execution; this workflow decides what to do with them.

Instantiates: Transitive Trust Boundary Hardening — it is the point-of-use gate that stops a trusted relationship from admitting a payload automatically.
Consumes: the pass/fail verdicts of the verification siblings (Sandboxed Payload Execution, Artifact Signature Verification, and others) as its promotion criteria.
Sibling mechanisms: Sandboxed Payload Execution · Canary Rollout with Kill Switch · Artifact Signature Verification · Content Disarm and Reconstruction · Provenance Attestation Check · Software Bill of Materials Review · Reproducible Build or Derivation Check · Dependency Lockfile and Allowlist · Package Namespace Confusion Guard · Multi-Source Release Corroboration · Transparency Log Monitoring · Trusted Update Channel Pin · Key Rotation and Revocation Drill · Trust Chain Red Team · Trusted Intermediary Compromise Tabletop

Notes¶

The workflow is deliberately a container and decision procedure, not a test — it holds and promotes, but forms no opinion of its own about whether a payload is safe. A quarantine with no real checks wired into its gate is just a delay dressed as a control; its assurance is entirely borrowed from the siblings whose verdicts it enforces.

References¶

[1] Security theater — measures that produce the feeling of security while adding little real protection (Bruce Schneier's term). A quarantine gate that never actually blocks anything is its canonical form; the corrective is to track how often the gate rejects. ↩