Explain the boundaries where Guardsquare App Attestation evidence is generated and verified. Confirming application identity does not give a user access to every server resource.
Evaluation approach
The vendor describes runtime-environment assessments and server-managed policies. Make evidence verification and transaction relationships explicit during integration.
Application example
When introducing a policy, monitor legitimate-request success alongside block counts.
Limits and considerations
Do not treat absolute product-page language as a result measured in your application.
Connect local protection to server authority
Attestation feeding API acceptance creates another trust boundary. Review verification-key management, evidence freshness and transaction binding. Keep ordinary client fields distinct from verified claims.
Even if policy can change independently of the application release, test its impact. Prepare a limited-cohort trial and quick rollback. Product demonstrations do not replace outage and retry scenarios in your own workflows.
Checks and decisions
- Test evidence verification
- Review request binding
- Test policy rollback
Demonstrate which attack paths require local RASP and server verification to work together.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.