LINC / SECURITY MODEL
A connection is not permission.
Encryption protects the route. Policy decides the flow. LINC separates connection, authorisation, release and durable acknowledgement.
Cross-domain use depends on independently approved gateways, policies and accreditation for each named flow.
Controls for each named flow.
01
Deny by default
What LINC does
Holds a message when policy is unknown or unavailable.
What LINC does not do
Does not treat a working connection as permission.
02
Separate export and import
What LINC does
Records independent decisions for the named flow and waits for durable destination acknowledgement.
What LINC does not do
Does not label an exported message as delivered.
03
Originator-controlled derivatives
What LINC does
Requires originator authority and independent approval of the exact derivative bytes.
What LINC does not do
Does not release a higher-classified original because some of its parts are lower-marked.
04
Protected provenance
What LINC does
Retains protected lineage at origin and shares only an approved opaque reference. Each side holds its own hash.
What LINC does not do
Does not disclose source lineage simply because the destination received a derivative.
05
Revocation and replay
What LINC does
Rejects replays after revocation and re-checks current policy after reconnection.
What LINC does not do
Does not revive an expired permission when a tunnel returns.
06
Auditable decisions
What LINC does
Retains decisions, transfer state and acknowledgement evidence for review.
What LINC does not do
Does not confer accreditation or certify an entire deployment.
Cross-domain use depends on independently approved gateways, policies and accreditation for each named flow.
Agree the route. Test the evidence.
Bring the systems, domains, permitted flows and operating constraints. Define acceptance evidence for that exchange.