Execution Surfaces — TrigGuard Authorization Boundaries

// What is an Execution Surface?

The Authorization Boundary

An execution surface is the point where an action becomes irreversible. TrigGuard sits at this boundary and authorizes (or blocks) the action before it executes.

Each surface has its own policy configuration, audit trail, and receipt format. You choose which surfaces to protect.

// Core Surfaces

deploy.release

Production deployments, release promotions, rollback decisions. Any action that changes what code is running in production.

kubectl apply helm upgrade argo sync release promotion

infra.apply

Infrastructure changes that modify cloud resources. State changes that are expensive or impossible to reverse.

terraform apply pulumi up cloudformation deploy crossplane sync

artifact.publish

Publishing artifacts to registries, signing releases, pushing container images. Once published, artifacts may be pulled by downstream systems.

docker push npm publish pypi upload oci push

database.migrate

Schema changes, data migrations, DDL operations. Changes that alter database structure or move large amounts of data.

rails db:migrate flyway migrate prisma migrate alembic upgrade

secrets.access

Credential retrieval, KMS decryption, vault reads. Access to sensitive material that could be exfiltrated or misused. TrigGuard authorizes the access event; the secret payload remains encrypted within your Vault/KMS.

vault read aws kms decrypt gcp secret access 1password get

data.export

Bulk data exports, backup downloads, report generation. Actions that move significant data outside the system boundary.

pg_dump data pipeline export analytics extract backup download

production.write

Direct writes to production databases, manual data modifications, batch operations against live systems.

psql production redis-cli prod mongo shell batch update

// Custom Surfaces

Define Your Own

TrigGuard supports custom execution surfaces. Define surfaces that match your organization's risk model.

# Custom surface example
{
  "surface": "payment.authorize",
  "action": "transfer-over-10k",
  "context": {
    "amount": 15000,
    "currency": "USD",
    "recipient": "external"
  }
}

Surface Naming Convention

Surfaces use dot notation: category.action. Keep names short, descriptive, and consistent across your organization.

// Get Started

Protect Your First Surface

Start with your highest-risk surface. Most teams begin with deploy.release or infra.apply.

Integration Guide Protocol Spec