Concepts

This page defines the terms the rest of the documentation uses. The Glossary has short definitions of every term.

Trusted execution environments (TEEs)

A TEE runs a workload in hardware-isolated memory that the host operating system, the hypervisor and the cloud operator cannot read. untrust covers these TEEs:

• AWS Nitro Enclaves: an isolated enclave carved out of an EC2 parent instance. The parent talks to the enclave over vsock.
• AMD SEV-SNP: confidential virtual machines, including GCP Confidential Space and Azure confidential VMs, and bare-metal SEV-SNP hosts.
• Intel TDX and Intel SGX: trust domains and enclaves on Intel hardware.
• Arm CCA realms and IBM Secure Execution guests, through enrolled collectors.
• NVIDIA GPU Confidential Computing: a GPU running in CC mode alongside a confidential VM.

Attestation

Attestation is a signed statement, produced by the hardware, of what was measured when the TEE launched: firmware, kernel, image and configuration. A relying party checks the signature against the vendor's trust roots and compares the measurements with values it expects, then decides whether to release a secret.

Attestation covers what was measured at launch. It does not cover:

• Bootstrap state the workload downloads after launch, such as an object in a bucket.
• Host-supplied inputs, such as environment files, network configuration and vsock services on the parent.
• Key-release policy: whether the key service actually requires an attestation, and whether it requires a real code measurement rather than an identity or debug value.

untrust checks those boundaries. Each check names the attack a failure enables.

Evidence

Evidence is what a verdict is based on. untrust records where each piece came from, and the console shows that provenance next to the result:

Evidence	Produced by	Trust
Scan report	untrust scan, run with your credentials	What the cloud APIs and the host returned to the scanner.
Build and IaC receipts	untrust buildscan and untrust iacscan in CI	Delivered with a short-lived CI identity token. An authenticated submission, not a verified attestation.
Collector bundle	An enrolled collector on a confidential host	Signed by the collector's enrolled key, then verified by the service against the hardware vendor's roots.
Detection events	untrust detect, untrust registry detect and collectors	Read from cloud audit logs and host reports.
Trust decision	untrust release verify, or untrust ledger collect for releases seen in cloud logs	A decision untrust made is decided; a release untrust only saw in a log is observed.

Evidence that could not be verified is shown as unverified. It is never shown as trusted.

Verdicts

Every check result is one of four verdicts:

Verdict	Meaning
PASS	The check ran and the configuration it reads meets the requirement.
FAIL	The check ran and found the weakness it looks for.
SKIP	Not assessed. The check did not run, usually because the scan was not given the input it needs, or because --read-only excluded it.
ERROR	Not assessed. The check started but could not reach a verdict, for example because an API call was denied.

Only PASS and FAIL are assessed results. A SKIP or ERROR is never counted as a pass, in the CLI summary, in a policy, in a compliance control or in a release decision. The console uses the word unknown for the same state.

Some checks also carry an assurance label that says how strong a pass is: report-derived (read from a report whose signature this check does not verify), probed (untrust tested it directly) or operator-declared (based on what you told the scanner).

Findings and issues

A finding is one check or rule result on one target. Findings come from every engine: posture checks, build rules, IaC rules, registry checks and collector verifiers. In the console, findings can be grouped into issues with an owner and a status, and failing checks that chain together are shown as attack paths.

Policies

A policy states what must be true, such as "key release requires an attested measurement". Rules in each lifecycle stage (Build, Infra, Supply, Attest, Test, Runtime) check it. A policy is:

• enforced when every applicable stage passes;
• partial when a stage has no covering rule or a rule did not reach a verdict;
• failing when any rule fails.

Partial is the honest state for a gap. It never collapses to enforced. Some policies are release gates: a key release is refused unless they are enforced. See the policy catalogue.

Fleets and collectors

A fleet is a group of confidential hosts of one platform that you manage together in the console. Each fleet has its own policy: the measurements and minimum firmware (TCB) levels its hosts must report.

A collector is the untrust collector agent running on a host in a fleet. You enroll it once with a one-time token. It then reports on a schedule, connecting outbound only, and signs each report with a key it created on the host. A host that stops reporting is shown as stale, and its last result is never presented as current.

Organizations and projects

An organization is your tenant in the hosted console. Members, API keys, connections, fleets and evidence belong to exactly one organization. Projects group resources inside an organization and can restrict which members see what. See Organizations, projects and roles.