TR-I-1 — /evaluation endpoint called externally to learn trust topology
Component: Trust Evaluation. Mitigations: The endpoint evaluates only publicly available trust information (ETSI TSL membership, OpenID Federation trust anchors, DID documents); no user identity, subject data, or non-public policy is exposed. Action: Network-restrict to application zone as defence-in-depth; authentication is not required given the intentionally public nature of the data
| Property | Value |
|---|---|
| Section | Information Disclosure |
| Owner | operator |
Mapped Controls
| Control | Title |
|---|---|
| SID-TRUST-02 | Multi-Registry Trust Framework Support |
Source: STRIDE analysis (April 2026), architecture/stride-threat-model.md