Pattern DD-D

Cross-domain publishing with a release decision

The diode controls direction; the release decision controls content — and they are different mechanisms.

Request a quote Talk to an engineer

Area: Data diodes
Environments: 1
Products used: 1

How it is built

One-way path
Data path
Path that does not exist

The diode enforces direction. The release decision governs content — and that is a person.

Used in these environments

Publishing between classification domainsThe hard part is not the transport but the release decision: who decides that this document may leave, and how is that recorded.

How it works

A document leaves a higher domain for a lower one. The diode enforces the direction; the release decision governs the content. They are different mechanisms and both are required.

The release decision is a person

Automate it and it becomes a rule — and a rule can be wrong in ways a person is not. The decision needs a mandate, a record and a name. Where the volume makes that impractical, the answer is to reduce what crosses, not to automate the judgement.

What comes back

Nothing. There is no query, no confirmation and no way for the low side to ask the high side for a correction. Publishing that assumes a feedback loop has to be redesigned before it meets the boundary, not after.