Deployment profile

Profile / auths.deploy/1

Deployment authorization● Release approved

action

deploy sha256:a91e…

audience

release-gateway / production

authority

2-of-3 · release team

constraints

eu-west · canary 10% → 100%

verified locallynetwork / 0

The deployment profile gives protocol meaning to the artifact digest, environment, configuration digest, strategy, and blast-radius constraints. Changing a covered field produces a different canonical action.

Admission and execution

auths-deployment applies deployment-specific replay and blast-radius safety after pure verification. The deployment executor receives the profile-decoded command, never mutable caller parameters.

Approval integrity

Reviewers authorize the deployment that enforcement later sees. A reusable role, broad scope, or authenticated session does not substitute for an artifact-bound proof.