2026 Q1 Technical Guidance Document(s)

[dcmiddle]

The Governing Board has agreed upon this strategy and a statement for the TAC:

“Transform the CCC into the acknowledged leader in creating and disseminating technical excellence for CC, promoting design best practice, use cases and reference architectures. Focus: best practice technical blueprints to service CC demand.

1. Mandate TAC with best practices || reference architectures || open source project integration"

We must pick our first documents to initiate in January.
I'd like everyone's thoughts in this issue to outline 1-2 documents.

[dcmiddle]

To get the ball rolling here's one proposal.

The IDC study identified "Validating attestation chains of trust" as the largest hurdle to adoption.
To make this more approachable we need a document talking about integration patterns.
CSPs and ISVs already have production usages. We should captures these.

Attestation results are not typically used in isolation from other security controls, rather it is part of some existing authorization flow. We should discuss how attestation fits in the context of security policy decisions. This may also include a recognition of datacenter physical security.

Audience: Potential Enterprise Adopters of Confidential Computing
Anti-Goal: Explaining standards. RATS is great for practitioners and experts, but it should not be the introduction to attestation for adopters. Likewise getting into EATs, EARs, AR4SI, etc. is not the right level for this document.

The Blueprints: CSP & ISV Production Patterns - derived generalized architectures from existing, deployed services.

• Blueprint A: The Identity Bridge (Managed Attestation)

  • Concept: Offloading raw evidence verification to a platform service that issues a standard OIDC (OpenID Connect) token.
  • Usage: Connecting CC workloads to standard PaaS resources (SQL, Storage) without modifying the downstream resource.
  • Reference Implementation
  • Enterprise integration points

• Blueprint B: The Secure Key Release (KMS Integration)

  • Concept: Tying the release of disk encryption keys or application secrets to the successful measurement of the boot chain and enclave identity.
  • Usage: "Lift and Shift" VM migration, encrypted data processing pipelines.
  • Reference Implementation: A CSP KMS
  • Enterprise integration points

• Blueprint C: The Collaborative Clean Room

  • Concept: Multi-party computation where data is only decrypted if the code hash matches the agreed-upon governance policy.
  • Usage: Financial fraud detection, healthcare data sharing, AI model training on private data.
  • Reference Implementation: ISV Cleanroom implementation
  • Enterprise integration points

[dcmiddle]

cc: @confidential-computing/tac-voting-members