Security rules Never trust IMAGE_ID, tags, or tenant self-report as workload identity. Never treat valid CPU + valid GPU evidence as sufficient without common challenge/workload binding. Never reuse a nonce after successful or failed verification. Keep raw hardware evidence parsing outside KMS release logic. KMS receives only normalized verified claims / VerifiedWorkload. Historical quotes must fail new challenges. GPU verification is required only when policy requires GPU confidential compute. Do not release plaintext secrets to an unattested channel; wrap/encrypt to the attested workload key. Any missing or mismatched field fails closed.