BRIEF / 01.A.01
The problem
A shared archive holds strategic information. Users, administrators, applications and backups have different capabilities. A compromise should not automatically combine all of those capabilities.
BRIEF / 01.A.02
Define the required properties
The Threat Model identifies which access rights are considered compromised and which consequences must be contained. The design defines who can decrypt, export or recover documents and which boundaries must remain effective.
BRIEF / 01.A.03
Architectural decisions
Storage, identities, key use and recovery are assessed as distinct trust domains. Separation is effective only if administrative powers cannot indirectly reconstruct access to the information. Copies, metadata and exports belong in the same scope.
BRIEF / 01.A.04
From decision to implementation
Measures can address privileges, decryption boundaries, sharing and recovery paths. Their configuration follows the circumstances and the responsibilities of those administering and using the information.
BRIEF / 01.A.05
How verification works
Checks start with the actual capabilities of the identities in scope: which documents they can obtain, which permissions they can change and which alternative paths they can use. Agreed tests include allowed and denied access and recovery of usable content.
BRIEF / 01.A.06
Limits of the conclusions
Separating storage administration from decryption does not remove exposure through a device or application authorised to process plaintext. Revoking access does not withdraw copies already obtained. These limits inform the decisions and project documentation.