The Continuous Trust Playbook: Verification After the Checkpoint Era

The operating thesis: trust is a rate, not a gate

The legacy model treats identity as a binary earned at onboarding: verified once, trusted forever. Its cost structure forced that design, because when a verification event costs dollars and tens of seconds, you ration it, and rationing means gates. Three developments broke the model's assumptions: the cost collapse at the client edge, where hardware attestation and on-device liveness produce a high-assurance signal in under 150 milliseconds at near-zero marginal cost; the fraud inversion, where the modern attacker's best move is to pass onboarding, not evade it; and the agentic explosion, where the population needing verification stopped being enumerable at onboarding at all.

Pull quote

“Onboarding does not disappear. It becomes the first entry in a ledger rather than the last word.”

Reference architecture: the five-plane stack

The continuous trust layer decomposes into five planes, each consuming the one below. The edge plane establishes hardware truth: secure enclave attestation, verified boot, and signed capture sessions answered in milliseconds. The forensic plane judges what hardware cannot: deepeye passive liveness and subdermal analysis, telemetry forensics across the session, and provenance correlation against the historical index. The credential plane, operated by Arc, validates eIDAS 2.0 attestations, mobile driver's licenses, ZKP tokens, and Know Your Agent credentials before any downstream system relies on them. The decision plane requests one trust decision per consequential action, assembling the cheapest sufficient evidence. The governance plane, run by Luna, converts operational exhaust into perpetual KYC records, screening, and examiner-ready evidence. The whole stack runs on the deepidv platform.

Phase 0: baseline audit (weeks 1-2)

Every deployment starts by measuring the checkpoint system you actually have, not the one the documentation describes. Phase 0 produces four artifacts: an action inventory listing every consequential action and its current trust basis, an evidence audit that examines what current verification actually proves, a latency and cost map, and a regulatory exposure register that maps which obligations apply now and which arrive within 24 months. The evidence audit routinely reclassifies a comfortable approval rate into a mixture of genuine approvals and undetected passes, and that undetected-pass estimate is what settles the investment case.

Phase 1: hardware-anchored capture (weeks 3-6)

Phase 1 deploys the edge plane, because everything above it inherits its guarantees. Integrate platform attestation across the device population, move liveness and capture forensics into the attested session so deepeye runs on frames the silicon has signed, and instrument the latency budget per device class and network condition. The fallback decision is the most consequential policy choice in the phase: unattested sessions must not fail open, and must not fail closed either, they route to the forensic plane with a higher evidence requirement and a lower velocity ceiling. Exit criteria: attestation coverage above 85 percent of sessions, injection suite passing on every supported OS, p99 edge decision inside budget.

Phase 2: forensic correlation and the historical index (weeks 7-10)

Phase 2 turns single-session judgment into fleet-level intelligence. The telemetry layers come online against live traffic in shadow mode first, scoring not blocking for two weeks so thresholds tune against your population. In parallel, the historical index ingests your verification archive and the provenance engine correlates generation lineage, asset reuse, and infrastructure echo, which typically surfaces confirmed fleets among previously approved accounts. Time-of-day context enters the model here, because the tampering data is unambiguous: overnight and holiday windows carry measured spikes approaching 46 percent, and a model that scores 3 a.m. like noon donates the attacker their favorite hours.

Phase 3: continuous compliance and credential ingestion (weeks 11-16)

Phase 3 attaches the credential and governance planes. Arc ingestion goes live for the credentials your population actually presents, each with a provenance policy for trusted issuers and revocation checking, and non-human identity onboards in the same frame through Know Your Agent screening. On the governance side, Luna assumes the compliance workload: perpetual KYC replaces calendar-based refresh, re-verifying on evidence such as a failed attestation or a fleet-correlation hit rather than on anniversaries; screening runs event-driven; and suspicious activity narratives assemble from the decision trail with typology matching, cutting drafting time from days to minutes while raising narrative quality to what regulators now measurably police.

Phase 4: adversarial assurance (ongoing)

The final phase never ends, which is the point. Arbiter runs continuously against the production stack using fraud persona kits matched to what circulates in criminal markets, deployed against your real endpoints under sandbox controls. The cadence that works: weekly automated campaigns against the edge and forensic planes, monthly full-kill-chain exercises, and event-driven campaigns within days of any new kit family appearing in the wild. A defense layer that cannot show you its latest red-team results, on your traffic, against current kits, is asking for faith; the continuous trust architecture is falsifiable by design, and Phase 4 is the falsification engine.

The regulatory map: one architecture, many mandates

The strongest budget argument for continuous trust is that a single architecture satisfies obligations arriving from every direction. Seven regimes, drafted independently, all demand evidence-grade verification at the moment of action rather than certification at the border, and the marginal cost of each additional mandate drops as the planes come online.

Measurement: the metrics that prove the layer works

Continuous trust programs die from unmeasured success as often as from failure. The minimum viable scoreboard, reviewed monthly, spans four families. Detection: injection interception rate against Arbiter campaigns, persona-kit fleet detections with confirmed-fraud conversion, and the undetected-pass trend. Performance: p50/p99 edge latency by device class, attestation coverage, and abandonment delta attributable to verification friction. Compliance: SAR/SMR narrative quality and filing-window performance, perpetual KYC triggers versus retired calendar refreshes, and mock-examination artifact production time. Economic: fraud loss per thousand actions by tier, cost per trust decision by evidence depth, and manual review hours displaced, the number that funds the program politically.

Failure modes: how these programs actually sink

Five patterns account for most failed migrations. The three-project split, where fraud, compliance, and engineering buy separately and the planes never share evidence. The fail-open fallback, where unattested sessions get waved through and the temporary bypass becomes the permanent attack route. The threshold freeze, where launch-tuned forensic thresholds are never revisited while generators evolve monthly. The shadow-mode residence, where scoring-not-blocking becomes a permanent home because blocking creates ownership of false positives. And the examiner surprise, where the system runs well but nobody rehearsed producing its evidence in regulator-facing form. Each has a defined countermeasure built into the phase exit criteria above.

Pull quote

“The institutions that build the continuous layer now will spend the next five years accepting customers, credentials, and agents their competitors cannot safely touch.”