CYBERSECURITY TRUST AUTHORITY
Examining the foundations of digital trust.
Explore how authentication evidence, authorization decisions, identity dependencies, and security assumptions shape effective access.
Samuel K. Thomas - Founder & CEO of QILAHK | Cybersecurity Trust Authority
Published October 10, 2026
QILAHK Advanced Research
Five research white papers exploring evidence, trust continuity, cryptographic provenance, federated authority, and AI agents.
Published October 12, 2026 · Version 1.1 · 8 pages per paper
QTA-R01
Evidence Aware Trust Computation
A trust decision needs a representation of what the evidence establishes, what it contradicts, and what remains unknown. Compressing these distinctions into a single score can conceal missing proof or count several copies of one observation as independent support. This paper proposes a QILAHK research model that evaluates scoped claims through an evidence dependency graph and produces an explanation that an authorized reviewer can reconstruct.
Read white paper (PDF)QILAHK branded cover · Contents · Abstract · References
QTA-R02
Temporal Trust Continuity
Trust continuity is a problem of justified reliance through time. A valid observation can become stale, a policy can change, and events can arrive after an earlier decision has been recorded. This paper proposes a QILAHK research architecture that retains observation time and ingestion time separately, pins the basis of each determination, and evaluates material changes against explicit claim dependencies.
Read white paper (PDF)QILAHK branded cover · Contents · Abstract · References
QTA-R03
Cryptographic Evidence Provenance
A signed artifact can be authentic to a key and still contain an inaccurate claim. A normalized record can be useful and still lose context essential to review. This paper proposes a QILAHK evidence provenance architecture that separates source authenticity, artifact integrity, transformation lineage, semantic appraisal, and authorized disclosure.
Read white paper (PDF)QILAHK branded cover · Contents · Abstract · References
QTA-R04
Federated Authority and Registry Consistency
A portable trust artifact creates a governance and distributed systems problem. A relying organization needs to know which authority may decide a particular claim, whether that authority remains valid, and whether the presented status reflects the latest applicable decision. A valid historical signature does not answer all three questions.
Read white paper (PDF)QILAHK branded cover · Contents · Abstract · References
QTA-R05
Runtime Trust for AI Agents
An AI agent can generate a plausible plan while lacking authority to perform a proposed action. It can also operate within nominal permissions while using an unapproved destination, stale context, or a changed tool configuration. This paper proposes a QILAHK research model that evaluates an action-specific Proof Surface before an external side effect is executed.
Read white paper (PDF)QILAHK branded cover · Contents · Abstract · References
These papers present proposed research architectures and evaluation plans. Illustrative scenarios and hypotheses are identified within each document.
Foundations of Digital Trust
EVIDENCE
Trust Boundary Failures in Modern Authentication Systems
Modern authentication systems distribute identity evidence across providers, browsers, applications, gateways, and resource services. Each handoff creates an opportunity to interpret a valid credential beyond the authority it establishes. This white paper examines failures involving issuer selection, recipient binding, credential purpose, account mapping, tenant context, session lifecycle, and delegated authority. Drawing on published standards and security research, it proposes a boundary contract that records the producer, consumer, accepted evidence, applicable context, resulting authority, and withdrawal conditions. An illustrative federated workflow demonstrates how separate checks can preserve assurance across components. Practical guidance translates the analysis into accountable ownership, a 90-day implementation plan, controlled verification, and leadership measures. The central recommendation is to assess the full path from authentication evidence to resource authorization rather than infer broad trust from successful login or signature validation. Examples are analytical and hypothetical; no new experiments or vulnerabilities are claimed.
Read white paper ↗PDF · Approximately 5,000 wordsAUTHORIZATION
Authorization Drift in Cloud-Native Architectures
Cloud-native authorization can change without a visible policy-file edit. Resource expansion, attribute updates, workload replacement, delegation, cached decisions, and temporary credentials can alter effective access or delay its withdrawal. This white paper defines authorization drift as divergence between approved access intent and enforcement over time, distinguishing excessive authority from failures to permit required operations. It examines configuration, platform semantics, identity lifecycle, propagation, and feasible paths to consequential authority. Published cloud documentation and authorization research support a practical operating model that combines a versioned intent record, platform-specific evaluation, controlled observation, and verified correction. A hypothetical temporal access review illustrates why static permission inventories cannot establish continuing alignment. Recommendations include semantic change review, explicit convergence requirements, exception expiry, accountable remediation, and a phased implementation plan. Proposed measures support prioritization and operational review; they are not estimates of breach probability or financial loss. The paper offers an actionable framework without claiming empirical validation of its effectiveness.
Read white paper ↗PDF · Approximately 5,000 wordsIDENTITY
Systemic Weaknesses in Identity-Centric Security Models
Identity-centric security places identity evidence and relationships at the center of access decisions, creating dependencies that extend beyond the primary login mechanism. This white paper examines systemic weaknesses in enrollment, recovery, federation, administration, machine identity, contextual signals, and authority withdrawal. It distinguishes authentication assurance from resource entitlement and models how shared authorities can affect several downstream services. Published standards and a bounded public incident account support analysis of dependency concentration, circular trust, and containment. The proposed approach maps authority-producing relationships and evaluates which independent controls continue to protect sensitive operations when a selected dependency becomes unreliable. Operational recommendations assign lifecycle responsibilities, constrain consequential administrative changes, preserve delegation context, and test recovery and restoration through a 90-day resilience program. Strong authentication remains valuable, while its contribution must be assessed alongside the surrounding dependency chain. Hypothetical scenarios illustrate the framework; the paper does not claim a complete enterprise model, measured resilience improvement, or newly conducted experiments.
Read white paper ↗PDF · Approximately 5,000 wordsASSUMPTIONS
When Trust Assumptions Fail: A Vulnerability Research Perspective
Unexpected authentication or authorization behavior becomes a defensible vulnerability finding when it can be connected to a supported security requirement and a reproducible change in authority. This white paper presents an assumption-centered assessment approach for authorized vulnerability research. An assumption ledger records the propositions behind sensitive workflows, their owners, supporting evidence, enforcement locations, and lifecycle conditions. Controlled context substitution, state-transition testing, and differential comparison then examine whether valid evidence remains applicable to the decision being made. A hypothetical cross-organization export workflow illustrates how a research lead can become a bounded counterexample, how alternative explanations can invalidate a finding, and how remediation must restore the invariant across related paths. Practical guidance covers evidence quality, independent reproduction, acceptance criteria, regression coverage, and closure, supported by a phased adoption plan and reporting measures. The approach is a proposed operating framework informed by standards and formal research; it is not presented as an empirically superior method or a report of newly discovered vulnerabilities.
Read white paper ↗PDF · Approximately 5,000 wordsEach white paper includes a separate title page, table of contents, abstract, practical recommendations, and references. These are analytical white papers informed by published sources; hypothetical examples are identified within the documents.
