Inheritance Platforms

Where the delta gets small

Lesson 1.3 promised that inheritance is how authorization gets fast; this lesson is what the platforms actually demand in exchange. The reference ecosystem is DoD’s — the most developed inheritance machinery in the field — but every element generalizes: a hardened-artifact repository, a platform stack that consumes it, and reusable certification constructs on top. Meridian’s team studies it because the federal energy-coordination system’s operators run on exactly this class of infrastructure — and their intake requirements become Meridian’s delivery requirements.

The hardened repository: gates you can compute

The pattern-setter is the DoD’s hardened container repository (Iron Bank): vendors submit container images; the repository hardens, scans, and — the teachable part — gates acceptance on quantified, published thresholds. The shape of its CVE gating (exact numbers fenced below):

QUANTIFIED GATES - the pattern:
  per severity class:  justification deadline   (days to explain a finding)
                       tolerance count          (how many may exist at all)
                       remediation window       (days to fix)
                       maximum finding age      (nothing lingers)
  plus an overall RISK SCORE computed from the above - a number,
  published, comparable across artifacts and over time

  The mainstream form of the same gate adds two inputs the count-only
  version lacks: KNOWN EXPLOITATION (is it on CISA's exploited list?) and
  REACHABILITY (does the vulnerable code path actually run here?) - and
  routes what remains into an exception with an OWNER and an EXPIRY.
  The 'justification files' the repository asks for map to two
  mainstream records: a VEX statement (the emerging standard for
  machine-readable 'not affected, because...') where the finding does
  not apply, and an EXCEPTION RECORD (owner + expiry) where it does and
  is accepted for now

Name this pattern too: quantified gates beat narrative review. A gate expressed as numbers is mechanically checkable (your pipeline can pre-check it before submission), arguable only on evidence (is this finding justified within its window, yes or no), and immune to the reviewer-mood variance that makes narrative acceptance unpredictable. It’s Lesson 2.1’s closed-vocabulary principle scaled up to an acceptance boundary — and it’s spreading beyond containers to every artifact class the ecosystem accepts. The strategic read: quantified gates are what allow inheritance to scale, because they remove the scarce human (Lesson 1.3’s arithmetic, once more) from the per-artifact accept/reject loop.

Vendor-seat consequence: run the destination’s gates as your own CI gates, at stricter thresholds. Arriving at the repository with findings inside their tolerances is table stakes; arriving with your justifications pre-written in their format is what fast onboarding actually looks like.

The platform above, and the cadence trick

On top of the hardened repository sits the platform stack (Big Bang-class): a curated, configured composition of the repository’s artifacts — the security stack, service mesh (the networking layer that encrypts and polices traffic between services), and policy machinery pre-integrated, deployable as a unit, releasing on a fixed short cadence. The under-appreciated insight is that cadence IS dependency management: consuming the platform’s biweekly-class releases keeps your delta perpetually small, while skipping releases accumulates an integration debt that compounds — the platform’s components, security posture, and APIs move together, and re-joining after six skipped releases is a migration, not an update. It’s trunk-based thinking (the DevSecOps Foundations training’s spine) applied to platform consumption: small, frequent, boring integrations beat rare, heroic ones.

Certificate to Field and its reciprocity siblings formalize the payoff: demonstrate that your artifact meets the platform’s standards, and the certification travels with the artifact across environments running that platform — inheritance made portable. This is what the competing vendor in Lesson 4.2’s quiz should have claimed.

The commercial paths, honestly

The government stack is not the only road, and pretending otherwise would fail Meridian’s actual decision. Commercial platform operators now hold their own provisional authorizations and sell landing-on-us as a product (one prominent operator holds its own DISA authorization; another builds air-gap-native deployment stacks); their pitch is exactly the inheritance model with a support contract. The honest evaluation uses Lesson 4.1’s instruments unchanged: what does their authorization actually cover (their class/baseline vs your data), where is the responsibility seam, what evidence do you receive continuously, and what happens to your certification story if you leave. Commercial inheritance is real inheritance — the seat and the method don’t change because the logo did. There is also a commercial counterpart to the hardened repository itself: vendors that sell pre-hardened, continuously-rescanned base images and components with published gates — the same pattern as a product category, minus the government intake.

The comparison leadership will ask for fits on one sheet — the same seven rows scored for a government platform and a commercial one:

ROW                               GOVERNMENT PLATFORM        COMMERCIAL PLATFORM
boundary + inheritable controls   which controls it answers  which controls its
                                  for, at which baseline     authorization covers, at
                                                             which class
evidence access + freshness       what you receive, how      same question - and is it
                                  often, in what format      continuous or on request?
customer-owned controls           your delta, enumerated     your delta, enumerated
onboarding time + lifecycle cost  intake gates, cadence      contract, onboarding, the
                                  you must keep up with      support tier you will need
availability / support / incident who is on the hook, with   same - read the SLA and the
obligations                       what clock                 incident clauses
data location + subprocessors     where it runs, who else    where it runs, who else
                                  touches it                 touches it
exit portability + re-auth cost   what leaves with you if    what leaves with you if you
                                  you move                   leave - and what must be
                                                             re-authorized

Fill both columns honestly and the decision usually makes itself; a column with blanks is a vendor conversation, not a decision.

Prompt first: the intake dossier

Target platform: [the destination's platform/repository]. Build our
intake dossier:
1) fetch their published acceptance gates and render them as OUR CI
   gate config at 80% of their thresholds - fail our build before it
   would fail their intake;
2) generate the justification-file skeleton in their format for every
   current finding we cannot remediate this sprint - evidence slots,
   not prose padding;
3) cadence plan: their release rhythm vs our integration capacity -
   recommend a consumption cadence and name the integration-debt
   ceiling (max releases we may skip) with the trigger that forces
   a catch-up;
4) reciprocity map: which certifications does landing here make
   portable, to where - the inheritance we are actually buying.

Practice status — among mature regulated delivery programs, commercial and federal

(a few rows carry a more specific status - principle, canon, suspended - where one of the five would mislead)

Scale: required | common baseline | strong optional | reference-shop (seen only at organizations that publish their own practice) | emerging

Key takeaway

Inheritance runs on three layers: a hardened repository whose quantified gates (numbers, not narratives) let acceptance scale; a platform stack whose short release cadence is the dependency-management mechanism — skip it and the debt compounds; and reciprocity constructs that make certifications portable across conforming environments. Run the destination’s gates as your own CI at stricter thresholds, plan consumption cadence with a debt ceiling, and evaluate commercial inheritance with the same instruments. Next: the contractor floor — the clauses that bind whether or not any certification program is running.

LEADERSHIP DECISION   choose the inheritance platform on the seven-row sheet,
                      and fund consumption cadence as a standing cost -
                      skipping releases is a loan at compound interest
PRACTITIONER ACTION   run the destination's gates as CI at stricter
                      thresholds; plan consumption cadence with a debt
                      ceiling; map what reciprocity makes portable
SUCCESS MEASURE       intake cleared on first submission; zero migration-sized
                      catch-ups; every open finding either carries a VEX not-
                      affected statement or sits in an exception with an owner
                      and an expiry date