Scope boundary

Owns pre-placement verification of authenticated, fresh evidence for the exact external provider, tier, region, runtime build, isolation mode, debug posture, and serving-state boundary. It consumes confidential-computing attestation when required but does not produce it.

AID-H-009.005: AID-H-032.004 decides whether external inference placement evidence satisfies workload policy; AID-H-009.005 verifies the confidential-computing attestation and binds it to key release. Provider placement consumes rather than substitutes for local attestation verification.

AID-H-032.001: AID-H-032.004 verifies the provider isolation profile available for placement; AID-H-032.001 requires dedicated capacity when shared placement remains unacceptable. Insufficient evidence can force the dedicated or lower-sensitivity path.

Implementation guidance

• AID-H-032.004-G001: Verify exact provider-isolation and, when required, confidential-runtime attestation evidence before routing a workload to a shared inference placement.

AID-H-032.004-G001

Evidence-bound placement gate

An authenticated adapter verifies evidence bytes, issuer, signature, expiry, revocation, and service-tier readback. When confidential inference is required, it also returns an AID-H-009.005 receipt bound to runtime measurement and key-release policy.

# File: inference/placement_admission.py
from __future__ import annotations
from datetime import datetime, timezone

def admit(workload: dict, evidence: dict, policy: dict) -> dict:
    required = {"provider", "service", "tier", "region", "runtime_build", "assurance_mode",
        "tenant_state_isolation", "debug_disabled", "issued_at", "expires_at", "policy_version",
        "signed_record_sha256", "service_readback_sha256", "attestation_receipt"}
    if set(evidence) != required: return {"status": "ERROR", "reason": "evidence_schema"}
    for key in ("provider", "service", "tier", "region", "runtime_build", "policy_version"):
        if evidence[key] != workload[key]: return {"status": "FAIL", "reason": key + "_mismatch"}
    if not evidence["tenant_state_isolation"] or not evidence["debug_disabled"]:
        return {"status": "FAIL", "reason": "isolation_requirement"}
    expires = datetime.fromisoformat(evidence["expires_at"].replace("Z", "+00:00"))
    if expires <= datetime.now(timezone.utc): return {"status": "INSUFFICIENT_DATA", "reason": "expired"}
    allowed = policy["allowed_assurance_modes_by_sensitivity"].get(workload["sensitivity"], [])
    if evidence["assurance_mode"] not in allowed: return {"status": "FAIL", "reason": "mode"}
    if evidence["assurance_mode"] == "confidential_attested":
        receipt = evidence["attestation_receipt"]
        if (not isinstance(receipt, dict)
                or receipt.get("status") != "PASS"
                or receipt.get("runtime_build") != evidence["runtime_build"]):
            return {"status": "FAIL", "reason": "attestation_binding"}
    return {"status": "PASS", "provider": evidence["provider"], "tier": evidence["tier"],
        "runtime_build": evidence["runtime_build"], "signed_record_sha256": evidence["signed_record_sha256"],
        "service_readback_sha256": evidence["service_readback_sha256"]}

Place this gate before route selection or key release. Re-run it on provider, tier, region, build, isolation mode, debug posture, verifier, key policy, expiry, or policy changes. Test wrong-tier, stale, revoked, missing-attestation, mismatched-build, enabled-debug, adapter timeout, and readback mismatch fixtures.

Open-source tools

• Keylime
• SPIRE
• Kata Containers
• Confidential Containers

Commercial / hosted tools

• NVIDIA Remote Attestation Service (NRAS)
• Intel Trust Authority
• Azure Confidential VMs
• Azure Confidential VMs with NVIDIA H100 GPUs (NCCads_H100_v5)
• Google Cloud Confidential VM
• Google Kubernetes Engine (GKE) Confidential Nodes with GPUs
• Google Cloud Confidential VM with GPUs
• Anjuna Seaglass
• AWS Nitro Enclaves (attestation evidence for enclave-hosted inference only)

Threat mappings

MITRE ATLAS

• AML.T0025 Exfiltration via Cyber Means

MAESTRO

• Data Leakage (Cross-Layer)

OWASP LLM Top 10 2026

• LLM02:2026 Sensitive Information Disclosure

OWASP ML Top 10 2023

• N/A

OWASP Top 10 for Agentic Applications 2026

• N/A

NIST Adversarial Machine Learning 2025

• NISTAML.036 Leaking information from user interactions

Cisco Integrated AI Security and Safety Framework

• AITech-8.2 Data Exfiltration / Exposure (gates shared serving on current target-bound isolation evidence)
• AITech-8.3 Information Disclosure (gates shared serving on current target-bound isolation evidence)

Google Secure AI Framework 2.0 - Risks

• SDD: Sensitive Data Disclosure

Databricks AI Security Framework 3.0

• Model 7.2: Model assets leak