Applications
What this screen is for
An application is the business system on whose behalf cryptographic work is done: a payments service, card issuance, a reporting pipeline. It records who owns that system and how sensitive it is, and it contains the cryptographic actors that authenticate and call the platform. The application itself never authenticates and holds no credential.
One business system can be registered as several applications to separate concerns, for example a producer that only encrypts and a consumer that only decrypts.
What must exist first
- A tenant you administer. Both SIMPLE and STANDARD tenants use this screen.
- The permission to list or read applications, which is what shows this screen. Creating an application, deleting one, and reading deleted applications are further permissions, each held separately.
Decisions you make here
Creating an application
With the permission to create applications, Create Application opens a wizard that asks for:
- Identity: the Application Name, required and unique in your tenant, which is the application's technical name; an optional Display Name shown in lists; and a Description.
- Business Info: the environment, business unit, cost center, owner and technical contact.
- Risk & Compliance: the data classification, risk level and regulatory scope.
- Review & Create, where you confirm everything before the application is created.
Creating an application also creates its Default Cryptographic Actor. That actor has no credential yet, so nothing can authenticate as it until a credential is issued for it.
On a STANDARD tenant, the next step is usually to issue a credential for the Default Actor and to decide what it may do. On a SIMPLE tenant, provision an internal use case for the application instead: the use case composes the actor, credential and grants itself.
Adding an actor to an application
On a STANDARD tenant, with the permission to create actors, opening an application offers Add Actor. It creates an additional cryptographic actor under that application, for example one actor for each external processor. SIMPLE tenants do not get this control.
Deleting an application
With the permission to delete applications, Delete Application in the application's detail is terminal and cannot be undone. You confirm it by typing the application's name. Nothing the application contains blocks the deletion, so review what it holds before you confirm. The deletion reaches all of it:
- Its internal use cases and capability grants are revoked, its exchange contexts are closed, and its cryptographic exchanges are revoked.
- Every one of its cryptographic actors is disabled, including the Default Actor, so nothing can authenticate as them any more.
- Keys used only through this application's actors are archived, with their material retained and never destroyed. A key still used by an actor outside this application keeps its current state, and so does a key reached only through an internal use case.
With the permission to read deleted applications, a Retired tab lists the deleted applications and what each one contained, read-only. There is no restore.
Reviewing activity
Opening an application shows its Crypto Activity: the recent cryptographic operations performed under it.
How it relates to other screens
The actors an application contains, their credentials and their roles are managed on the actors screen:
An internal use case is always provisioned for an existing application: