Use case 02 of 03 path & jurisdiction assurance

Prove the traffic took the path you prescribed.

Through inspection, inside the border. This is the failure encryption, mTLS and endpoint telemetry all wave through — and the same mechanism answers tenant isolation.

23%

of impactful outages now come from IT and networking issues Uptime Institute · Annual Outage Analysis 2025 (2024 data)
change management and misconfiguration

85%

of human-error outages trace to procedures not followed, or flawed Same report · nearly 40% of organisations had one in the last three years

241 days

mean time to identify and contain a breach IBM · Cost of a Data Breach 2025
the window a rewritten path stays invisible

What we move: per-SID counters are unsampled, so “no undeclared segment was ever executed” becomes a provable negative — at any volume, including the low volume an attack actually has.

0100 the gap

Encryption proves who. It never proves where.

mTLS tells you the two ends were who they claimed. It says nothing about the route between them — which country the packet crossed, which appliance saw it, whether it left the tenant at all.

Classic routing is emergent: the path is observed after the fact, never declared, with no artifact to check against. There is nothing to compare, so nobody compares.

With a segment list, comparison stops being interpretation and becomes a set operation.

The SID list is the declared path, written into the packet: explicit, diffable, machine-readable. Per-segment counters then say whether it was executed — not whether an alert fired.

0200 the mechanism

One flow. One artifact. Three witnesses.

Each source is used only for what it can prove: counters for execution, probes for reachability, flow records for classification. The verdict is the intersection, not any one of them alone.

The stage-three assurance flow: a declared segment list is carried in the packet, per-segment counters and probes and classified flow records each report independently, and the verdict ledger records conformance per scope with exceptions escalated to a named human.

A denied probe is a security event, never a candidate rule.

e000 End.DT6 deliver

Start where it is already provable.

The entry is the read-only audit on what runs today — 30–60 minutes, on your own kit, and you keep the gap list either way.

Book 30 minutes The whole picture →