{
  "generatedFrom": "Payments Signal canonical architecture registry",
  "notice": "SYNTHETIC / TRAINING ONLY",
  "blueprintId": "architecture-security-resilience",
  "versionLabel": "Payments Signal reference architecture v1",
  "reviewDate": "2026-07-23",
  "traces": [
    {
      "id": "sec-trusted-payment",
      "label": "Trusted release and recoverable evidence",
      "summary": "Follow the controls that authenticate, authorise, protect, observe, and safely recover one payment action.",
      "viewId": "component",
      "steps": [
        {
          "id": "sec-trusted-payment-step-1",
          "title": "Establish identity",
          "nodeId": "sec-identities",
          "interfaceId": "sec-e1",
          "plainExplanation": "A human, service, or participant presents current verifiable identity.",
          "businessState": "Actor authenticated"
        },
        {
          "id": "sec-trusted-payment-step-2",
          "title": "Prove authority",
          "nodeId": "sec-entitlements",
          "interfaceId": "sec-e2",
          "plainExplanation": "Role, amount, service, product, and context permit this exact action.",
          "businessState": "Action authorised"
        },
        {
          "id": "sec-trusted-payment-step-3",
          "title": "Protect integrity",
          "nodeId": "sec-secrets",
          "interfaceId": "sec-e3",
          "plainExplanation": "Signing and verification use controlled key material and current trust.",
          "businessState": "Trust material current"
        },
        {
          "id": "sec-trusted-payment-step-4",
          "title": "Validate the boundary",
          "nodeId": "sec-boundary",
          "interfaceId": "sec-e4",
          "plainExplanation": "Identity, authority, integrity, replay, schema, and size checks pass.",
          "businessState": "Traffic admitted"
        },
        {
          "id": "sec-trusted-payment-step-5",
          "title": "Process in a controlled runtime",
          "nodeId": "sec-platform",
          "interfaceId": "sec-e5",
          "plainExplanation": "The runtime uses protected state and emits a correlated business event.",
          "businessState": "Payment action recorded"
        },
        {
          "id": "sec-trusted-payment-step-6",
          "title": "Observe the outcome",
          "nodeId": "sec-observability",
          "interfaceId": "sec-e7",
          "plainExplanation": "Security and payment telemetry can reconstruct the action without exposing unnecessary data.",
          "businessState": "Control evidence retained"
        },
        {
          "id": "sec-trusted-payment-step-7",
          "title": "Keep recovery payment-safe",
          "nodeId": "sec-continuity",
          "plainExplanation": "If service fails, queue, ledger, and settlement state govern staged reopening.",
          "businessState": "Recovery boundary known"
        }
      ],
      "evidence": [
        {
          "ref": {
            "sourceId": "bis-cpmi-cyber-resilience",
            "locator": "Governance through recovery",
            "label": "official-requirement"
          },
          "verifiedDate": "2026-07-23",
          "versionContext": "CPMI-IOSCO cyber-resilience guidance"
        },
        {
          "ref": {
            "sourceId": "bis-cpmi-pfmi",
            "locator": "Principle 17",
            "label": "official-requirement"
          },
          "verifiedDate": "2026-07-23",
          "versionContext": "CPMI-IOSCO Principles for financial market infrastructures"
        },
        {
          "ref": {
            "sourceId": "payments-signal-editorial",
            "locator": "Payment security, trust boundaries, observability, continuity, and recovery",
            "label": "simplified-educational-illustration",
            "simplifications": "Control ownership, cryptographic protocols, recovery objectives, data residency, privileged-access model, continuity sites, and regulatory duties depend on the institution, service, jurisdiction, risk assessment, and deployment."
          },
          "verifiedDate": "2026-07-23",
          "versionContext": "Payments Signal reference architecture v1"
        }
      ]
    }
  ],
  "stressCases": [
    {
      "id": "sec-stress-credential",
      "label": "Privileged credential is compromised",
      "trigger": "A privileged identity is suspected of unauthorised payment or configuration action.",
      "divergesAfterStepId": "sec-trusted-payment-step-2",
      "traceId": "sec-trusted-payment",
      "affectedNodeIds": [
        "sec-identities",
        "sec-entitlements",
        "sec-observability",
        "sec-governance"
      ],
      "affectedInterfaceIds": [
        "sec-e1",
        "sec-e2",
        "sec-e5"
      ],
      "lastConfirmedState": "Identity and action history exist; legitimacy is uncertain.",
      "settlementState": "Settlement varies by each affected payment and must be traced.",
      "fundsState": "Books and external movements must be reviewed individually.",
      "owner": "Security incident command and payment control owner",
      "safeAction": "Revoke access, contain sessions, freeze affected authority, and trace every action to payment and settlement evidence.",
      "requiredEvidence": [
        "Authentication events",
        "Entitlement history",
        "Configuration changes",
        "Payment and ledger references"
      ],
      "recoverySteps": [
        "Rotate credentials",
        "Review and correct unauthorised actions",
        "Revalidate controls before restoring access"
      ],
      "evidence": [
        {
          "ref": {
            "sourceId": "bis-cpmi-cyber-resilience",
            "locator": "Response and recovery",
            "label": "official-requirement"
          },
          "verifiedDate": "2026-07-23",
          "versionContext": "CPMI-IOSCO cyber-resilience guidance"
        },
        {
          "ref": {
            "sourceId": "payments-signal-editorial",
            "locator": "Payment security, trust boundaries, observability, continuity, and recovery",
            "label": "simplified-educational-illustration",
            "simplifications": "Control ownership, cryptographic protocols, recovery objectives, data residency, privileged-access model, continuity sites, and regulatory duties depend on the institution, service, jurisdiction, risk assessment, and deployment."
          },
          "verifiedDate": "2026-07-23",
          "versionContext": "Payments Signal reference architecture v1"
        }
      ]
    },
    {
      "id": "sec-stress-key",
      "label": "Signing service is unavailable",
      "trigger": "Outbound network messages cannot be signed with current trusted keys.",
      "divergesAfterStepId": "sec-trusted-payment-step-3",
      "traceId": "sec-trusted-payment",
      "affectedNodeIds": [
        "sec-secrets",
        "sec-boundary",
        "sec-platform"
      ],
      "affectedInterfaceIds": [
        "sec-e3",
        "sec-e4"
      ],
      "lastConfirmedState": "Payments may be approved internally but cannot cross the protected boundary.",
      "settlementState": "External settlement has not been initiated for queued messages.",
      "fundsState": "Internal reservations or postings depend on product design.",
      "owner": "Network security and payment operations",
      "safeAction": "Queue securely and invoke only the approved alternate signing or connectivity path.",
      "requiredEvidence": [
        "Key status",
        "Queued message hashes",
        "Approval and cut-off",
        "Alternate-path authority"
      ],
      "recoverySteps": [
        "Restore trusted signing",
        "Revalidate queued messages and authority",
        "Release once with original identifiers"
      ],
      "evidence": [
        {
          "ref": {
            "sourceId": "payments-signal-editorial",
            "locator": "Payment security, trust boundaries, observability, continuity, and recovery",
            "label": "simplified-educational-illustration",
            "simplifications": "Control ownership, cryptographic protocols, recovery objectives, data residency, privileged-access model, continuity sites, and regulatory duties depend on the institution, service, jurisdiction, risk assessment, and deployment."
          },
          "verifiedDate": "2026-07-23",
          "versionContext": "Payments Signal reference architecture v1"
        }
      ]
    },
    {
      "id": "sec-stress-failover",
      "label": "Failover restores a stale queue",
      "trigger": "The recovery site has an earlier queue checkpoint than the ledger or network.",
      "divergesAfterStepId": "sec-trusted-payment-step-6",
      "traceId": "sec-trusted-payment",
      "affectedNodeIds": [
        "sec-continuity",
        "sec-platform",
        "sec-observability"
      ],
      "affectedInterfaceIds": [
        "sec-e7",
        "sec-e8"
      ],
      "lastConfirmedState": "Ledger and network may be ahead of the restored queue.",
      "settlementState": "Some payments may already be settled.",
      "fundsState": "Replaying the queue could duplicate value.",
      "owner": "Incident command, ledger, and payment operations",
      "safeAction": "Stop replay and reconcile business keys across queue, ledger, network, and statements.",
      "requiredEvidence": [
        "Recovery checkpoint",
        "Queue journal",
        "Ledger journal",
        "Network acknowledgements",
        "Statements"
      ],
      "recoverySteps": [
        "Rebuild the authoritative queue",
        "Mark completed work",
        "Replay only proven missing items",
        "Validate balances before full reopen"
      ],
      "evidence": [
        {
          "ref": {
            "sourceId": "bis-cpmi-pfmi",
            "locator": "Principle 17",
            "label": "official-requirement"
          },
          "verifiedDate": "2026-07-23",
          "versionContext": "CPMI-IOSCO Principles for financial market infrastructures"
        },
        {
          "ref": {
            "sourceId": "bis-cpmi-cyber-resilience",
            "locator": "Response and recovery",
            "label": "official-requirement"
          },
          "verifiedDate": "2026-07-23",
          "versionContext": "CPMI-IOSCO cyber-resilience guidance"
        }
      ]
    }
  ]
}