Plain TLS proves the server — but the server has no idea who is calling
──▶
TLS
🟩
Service B
caller: ???
unknown caller
🥷
Service C (rogue)
looks identical
impersonating AB can’t tell A from a rogue — and certs from a static CA expire and cause outages.
Every service has a VLAD and a short-lived SVID rooted in a provenance log
🟦
Service A
svid: spiffe://…/a
✓ verified by B◀──▶
mutual TLS
🟩
Service B
svid: spiffe://…/b
✓ verified by A
Both present their SVID and verify the other against the plog-rooted trust bundle. The rogue has no valid SVID → rejected.
SVIDs are short-lived and rotate on their own — the connection never drops
Service A SVID: …expiring…auto-renewed ✓