Compliant inference, by structure.

Privileged inference operations — model deployment, policy changes, node deregistration, audit log access — require step-up authentication beyond the baseline session. The DOSFI Identity Fabric enforces this through a layered authenticator model:

A node's hardware identity is not a static credential — it is bound into every routing decision and inference session it touches. This binding is structural:

• Routing decisions carry the selected node's public key fingerprint. The SDK verifies the decision signature and the node identity match before dispatching.
• Inference session tokens are bound to the node's device key via DPoP (Demonstrating Proof-of-Possession). A stolen token cannot be replayed from a different device.
• Result attestation is signed by the same device key that registered the node. Signature mismatch triggers investigation and reputation penalty.

Every inference request passes through a validation pipeline before the Router Engine assembles the candidate node pool. Validation is ordered so that the cheapest checks run first:

1. Identity & authentication — token signature, expiry, revocation status.
2. Authorization — RBAC role + ABAC attributes against the routing policy.
3. Privacy gate — structural check: does the declared privacy policy permit the requested route tier?
4. Model eligibility — is the requested model available on at least one eligible node or cloud provider?
5. Rate & quota — per-key and per-organization usage limits.

A failure at any stage short-circuits the pipeline. No downstream component ever sees a request that failed an earlier check.

The Observability Fabric maintains an append-only hash chain for every compliance-relevant event. Entries cannot be modified or deleted — only appended. The chain is periodically anchored to external timestamp authorities for non-repudiation.

Apps that process PHI must declare their data usage in a machine-readable Permission Manifest registered with the DOSFI Identity Fabric. The Coordinator enforces these declarations as hard routing constraints:

{
  "data_classes": ["phi"],
  "phi_routing": {
    "local": "always",
    "mesh": "opt_in_with_consent",
    "cloud": "deidentified_only"
  },
  "retention": "session_only",
  "audit_level": "full",
  "consent_required": true,
  "purpose_limitation": ["clinical_decision_support", "summarization"]
}

Nodes that process PHI must meet elevated security requirements. The Coordinator blocks PHI routing to any node that does not satisfy all of the following:

• Hardware-backed keypair (TPM / Secure Enclave / StrongBox) — no software-only keys.
• Verified attestation measurement matching a HIPAA-eligible node profile.
• Sandboxed inference process with no network access, no disk write, and no IPC.
• Reputation score above the HIPAA eligibility threshold.
• Geographic region permitted by the organization data residency policy.

Every inference payload carries a purpose tag and a consent token. The Coordinator blocks routing outside the declared purpose — this is enforced at the privacy gate, before any node selection occurs.

Users can export their inference-related data in machine-readable format through an authenticated endpoint. The export is user-controlled and scoped to the requesting identity:

# Request a personal data export
curl -X POST "https://api.meshinfer.ai/v1/privacy/export" \
  -H "Authorization: Bearer msk_live_..." \
  -d '{"format": "json", "scope": "all"}'

# Request erasure of personal inference data
curl -X DELETE "https://api.meshinfer.ai/v1/privacy/erase" \
  -H "Authorization: Bearer msk_live_..." \
  -d '{"scope": "all", "confirm": true}'

No inference request is executed until it has passed every applicable policy check across all four DOSFI fabrics. The enforcement order is fixed and non-bypassable:

1. Identity Fabric — authenticate the caller and verify node identity.
2. Policy Fabric — evaluate RBAC/ABAC and routing policy.
3. Privacy/Data Fabric — enforce data minimization, consent, and purpose limitation.
4. Observability Fabric — emit audit entries for every enforcement outcome.

Only after all four fabrics pass does the request reach the Router Engine for node selection. A failure at any stage produces an audited denial — never a silent fallback.