Every decision rests on roots the customer holds.

QECNet Trust Fabric is not a separate platform alongside Verity Command. It is the layer every other module stands on: the Authority Kernel verifies identities against it, the Evidence Ledger signs with keys it manages, Tunnel Sovereign encrypts to endpoints it enrolls, and Verity Edge checks revocation state it distributes. Verity Command is powered by QECNet Trust Fabric.

• IdentityDistinct principal types for people, services, AI agents, devices, sensors, guests and partner domains.
• Key lifecycleGeneration, enrollment, rotation, escrow policy and retirement under recorded ceremony.
• Policy enforcementSigned, versioned policy bundles distributed to every enforcement point.
• Device trustDevice keys in hardware-backed storage where the platform supports it, with posture checks.
• Service trustWorkload identity and mutual authentication with short-lived credentials.
• Agent trustRegistered agent definitions, with each running instance bound to its delegator.
• Cryptographic controlEstablished, standard primitives and protocols; no proprietary encryption.
• Revocation foundationsSigned revocation state and authority epochs that enforcement points honor.
• Customer-controlled roots of trustSigning, encryption and identity roots generated inside the customer domain.
• Evidence signing foundationsKeys and trusted time that make decision records verifiable.

In sovereign deployments the vendor holds no key that can authorize, decrypt or sign inside the customer domain, and has no standing access to it. Support access, when needed, is customer-approved, time-bound and evidenced.

The same property carries a responsibility that is stated rather than implied: because the customer holds the roots, a compromise of those roots is a compromise of that authority domain, and the vendor cannot recover it. Root key ceremonies, custody and separation of duties are therefore part of deployment, not an afterthought.

Revocation takes effect at an enforcement point when that point receives the signed revocation state, and in every case no later than the expiry of the grant or lease. A connected enforcement point learns of revocation promptly. A disconnected one cannot be reached, so its residual authority is bounded by its lease — and the maximum residual window is shown to the commander at the moment of revocation.

Revocation is therefore never described as instantaneous everywhere. The honest bound is the lease.