Azure · Product tour

Confidential AI Network on Microsoft Azure

End-to-end narrative: Entra sign-in → Ricardian contract → Key Vault & confidential compute → governed prediction.

CAN

Multi-party training

Azure

Entra · AKS · Key Vault · Blob · TEE

DEPA-inspired

Use-bound sharing, not a data lake

Agenda

What we will walk

Why Azure + CAN · DEPA inspiration
Control plane map (research / pilot)
E2E tour — registration through prediction
DEK/MEK escrow · TEE attest-then-decrypt
Open-GMASE + CompliancePulse
Operator checklist · scope boundaries · CTA

Problem

Exports and NDAs are not a control plane

Today	What breaks
Bulk export + NDA	Sovereignty, liability, audit failure
“Train in our VPC” handshake	No machine-enforceable terms
Shared data lake	Competitive & regulatory non-starter

Inspiration

iSPIRT DEPA → enterprise AI

Consent-based, accountable sharing: use-bound access and evidence—not bulk dumps into a lake.

DEPA idea	CAN on Azure
Principal keeps control	TDP owns DEK; ciphertext in Blob
Purpose limitation	Ricardian contract + Entra roles
Auditability	Provenance · AuditLogs · CompliancePulse

depa.world

Azure

What this tour covers

Capability	Narrative
Microsoft Entra ID	Sole app IdP · app roles TDC/TDP/CCRP/AppAdmin
Edge	Front Door / WAF → APIM → private AKS
Key Vault + Blob	Secrets, CMK, ciphertext datasets/models
Confidential compute	Attest → dual-key escrow → decrypt-in-memory → train
Governance	Open-GMASE OPA · CompliancePulse ingest

Label Partial/Design items as “production target” if not yet live in the tenancy.

Architecture

Azure control plane

Users (TDP / TDC / CCRP)
         │  Entra ID (OIDC + app roles)
         ▼
Front Door / WAF  →  APIM  →  CAN on AKS
                              │
         ┌────────────────────┼────────────────────┐
         ▼                    ▼                    ▼
   Azure Key Vault      Blob (CMK)         Confidential compute
   secrets · CMK        ciphertext         attest → decrypt → train
         │                    │                    │
         └────────────────────┴────────────────────┘
                              ▼
                   Provenance · SIEM · CompliancePulse

Roles

Who does what on the tour

Role	Entra	In the demo
TDP	TDP	Publish ciphertext · sign · release DEK
TDC	TDC	Contract · MEK · train · deploy · predict
CCRP / TSP	CCRP	Azure confidential offering · attested session
Auditor	Auditor	Merkle audit tree · contract review (read-only)
AppAdmin	AppAdmin	Tenancy health (optional)

Tour map

Ten beats to a governed prediction

1 Entra register → 2 Blob catalog → 3 Contract + Key Vault
→ 4 Multi-party sign → 5 Attest + DEK/MEK escrow
→ 6 Train in TEE → 7 Provenance → 8 Deploy + predict
→ 9 Open-GMASE ALLOW (+ CompliancePulse)
→ 10 Auditor: Merkle tree + contract review

Same product story as the public product tour—Azure services underneath.

Steps 1–2

Entra registration · Blob catalog

Entra SSO — MFA / Conditional Access per customer policy. Keycloak is local-only.
Catalog — TDP publishes dataset ciphertext to Blob (CMK); TDC selects model; plaintext stays out of the portal.

Screenshot: swap live Azure captures into the speaker appendix list when a tenancy is available.

Steps 3–4

Ricardian contract · multi-party sign

Use, duration, region, confidential SKU, Key Vault kmsConfigs
Notify TDP + CCRP; cryptographic sign (Key Vault–backed in the production target)
No training until required signatures complete

Step 5 · KMS

DEK + MEK dual-key escrow

Key	Owner	Protects
DEK	TDP	Dataset
MEK	TDC	Model IP

Train starts only when both are released after policy OK. Platform must not hold principal key plaintext.

Step 6 · TEE

Attest → verify contract → decrypt

Provision confidential VM / enclave
  → Attestation quote
  → Principals verify quote ∧ contract
  → DEK + MEK into TEE (attested channel)
  → Decrypt in memory → train → re-encrypt
  → Zeroize → destroy session

Decrypt is a privilege, not a default.

Steps 7–8

Train · provenance · deploy · predict

Job on AKS / confidential compute (label local-docker as non-TEE if used)
Open-GMASE gates start_training fail-closed
Provenance: attested · keys released · started · completed · destroyed
Register → Deploy for inference → prediction (tabular / text / vision samples)

Step 8b · Auditor

Merkle audit tree + contract review

Auditor role — global read, no sign/train
Inspect root hash + leaf inclusion proofs for the training contract
Open the Ricardian contract the model was trained under

Screens: 25-auditor-workspace · 26-auditor-audit-tree · 27-auditor-contract-review

Step 9 · Governance

Open-GMASE + CompliancePulse

CAN side effect → Open-GMASE OPA → AuditLogs → CompliancePulse ingest

Inference UI shows ALLOW + audit id
Forwarded: decision metadata — not pixels, corpora, or weights

One sentence

The Azure narrative in one sentence

CAN binds multi-party training in a Ricardian contract, unlocks DEK/MEK only after parties accept an attested confidential session (target path), trains in the enclave, and serves a prediction under an Open-GMASE policy gate—with evidence for GRC.

Ops

Live demo checklist

#	Check
1	Entra users + roles
2	APIM / app healthy
3	Key Vault + Blob via workload identity
4	CCRP confidential offering published
5	Sample ciphertext in catalog
6	OPA up; gates on
7	CompliancePulse ingest set (or explicitly off)
8	Screenshot / recording backup

Trust

Scope boundaries

In scope / live	Do not imply
Entra is the Azure IdP	Keycloak runs in customer Azure
Local Docker covers UX	Local Docker is a hardware TEE
Dual-key escrow is the design	SaaS holds DEK/MEK plaintext
OPA gates side effects	Prompts are the control plane

Close

Next steps

Product tour: gitmujoshi.github.io/.../product-tour
Contract → prediction blog · KMS · TEE posts on the same site
Repo: github.com/gitmujoshi/Confidential-AI-Network

Ask: pilot tenancy · Entra roles · CCRP confidential SKU · GRC evidence pack