Update use cases: Krypton naming, generic platform language, deployment models

docs/use-cases/001-OpenKCM-Platform-Mesh-Integration.md

@@ -1,90 +1,90 @@
 ---
 authors:
   - Aysan
+last_updated: 2026-07-15
 ---
 
 ## Persona
-**Platform Users** - Anyone with access to an account in Platform who enables OpenKCM via Platform Mesh and accesses the OpenKCM CMK UI for management of their keychain (e.g., configuring CMK with HYOK or BYOK). These users interact exclusively with the CMK Layer of OpenKCM through the web interface, while the Crypto Service operates as an integrated backend service.
+**Platform Users** - Anyone with access to an account in a platform who enables OpenKCM and uses it to manage their customer encryption keys (e.g., configuring HYOK or BYOK). These users interact with OpenKCM to configure their key hierarchy, while Krypton operates as the integrated backend that executes all crypto operations.
 
 ## Overview
 
-As a Platform User, I need to enable OpenKCM encryption services for my account/tenant through Platform Mesh. This integration provisions the CMK Service with its web UI and automatically configures the backend Crypto Service. Platform Users work exclusively with Customer Managed Keys (CMK) through the CMK UI interface.
+As a Platform User, I need to enable OpenKCM for my account through a platform. This integration provisions OpenKCM and automatically configures Krypton as the backend. Platform Users configure and manage their Customer Managed Keys (CMK) through OpenKCM.
 
 ## User Stories
 
 ### Story 1: Enable OpenKCM for My Account
 **As a** Platform User  
-**I want to** enable OpenKCM encryption services for my account  
-**So that** I can manage my customer encryption keys through the CMK UI  
+**I want to** enable OpenKCM for my account  
+**So that** I can manage my customer encryption keys  
 
 **User Journey:**
-1. I create a new account or tenant in KCP
-2. Platform Mesh automatically detects the new tenant resource
-3. The system triggers OpenKCM CMK Service provisioning
-4. The backend Crypto Service is automatically configured and integrated
-5. I receive notification that OpenKCM CMK UI is ready
-6. I can now access the CMK web interface to configure my encryption keys
+1. I create a new account in my platform
+2. The platform automatically detects the new account and provisions OpenKCM
+3. Krypton is automatically configured and integrated as the crypto backend
+4. I receive notification that OpenKCM is ready
+5. I can now configure my encryption keys through OpenKCM
 
 ### Story 2: Configure My Customer-Managed Encryption
 **As a** Platform User  
-**I want to** set up my Customer Managed Keys through the CMK UI  
+**I want to** set up my Customer Managed Keys in OpenKCM  
 **So that** I have full sovereignty over my encryption keys  
 
 **User Journey:**
-1. I log into the OpenKCM CMK UI through my KCP account
+1. I log into OpenKCM through my account
 2. I see the key configuration dashboard
 3. I choose my preferred key management approach (BYOK or HYOK)
 4. I configure my external key store (AWS KMS, Azure Key Vault, etc.)
-5. The CMK Service coordinates with the backend Crypto Service
+5. OpenKCM validates the configuration with Krypton
 6. I receive confirmation that my customer-managed encryption is active
-7. I can monitor and manage my keys through the CMK UI
+7. I can monitor and manage my keys through OpenKCM
 
 ### Story 3: Configure BYOK (Bring Your Own Key)
 **As a** Platform User  
-**I want to** use my existing encryption keys from my cloud provider  
+**I want to** use my existing keys from my cloud provider  
 **So that** I can maintain consistency with my existing security infrastructure  
 
 **User Journey:**
-1. I access the OpenKCM CMK UI configuration wizard
+1. I open the key configuration in OpenKCM
 2. I select "Bring Your Own Key (BYOK)"
 3. I provide my existing key ARN/URI from AWS KMS, Azure Key Vault, or GCP KMS
-4. I configure the necessary permissions and trust relationships through the UI
-5. The CMK Service validates my key configuration with the backend Crypto Service
-6. My applications begin using my own keys for encryption (handled by Crypto Service)
-7. I can monitor my key status and usage in the CMK UI dashboard
+4. I configure the necessary permissions and trust relationships
+5. OpenKCM validates my key configuration through Krypton
+6. My applications begin using my own keys for encryption (handled by Krypton)
+7. I can monitor my key status and usage in OpenKCM
 
 ### Story 4: Set up HYOK (Hold Your Own Key)
 **As a** Platform User with strict compliance requirements  
 **I want to** keep my encryption keys in my own HSM or on-premises systems  
 **So that** I maintain complete control and meet regulatory requirements  
 
 **User Journey:**
-1. I choose "Hold Your Own Key (HYOK)" in the CMK UI during setup
+1. I choose "Hold Your Own Key (HYOK)" in OpenKCM during setup
 2. I configure connection to my HSM or on-premises key management system
-3. I provide necessary certificates and connection details through the CMK interface
-4. The CMK Service establishes secure communication with my key store via the Crypto Service
-5. I verify through the CMK UI that keys never leave my controlled environment
+3. I provide necessary certificates and connection details
+4. Krypton establishes secure communication with my key store
+5. I verify in OpenKCM that keys never leave my controlled environment
 6. My data is encrypted using keys that remain under my physical control
-7. I can monitor the connection status and key health in the CMK dashboard
+7. I can monitor the connection status and key health in OpenKCM
 
 ## Requirements
 
 ### Functional Requirements
 
 #### For OpenKCM Service Enablement:
-- **REQ-001**: System must automatically detect new tenant/account creation in KCP
-- **REQ-002**: Platform Mesh must trigger OpenKCM CMK Service provisioning without user intervention
-- **REQ-003**: Backend Crypto Service must be automatically configured and integrated
-- **REQ-004**: User must receive clear notification of CMK UI availability
-- **REQ-005**: OpenKCM CMK UI must become accessible once provisioning completes
-- **REQ-006**: User must be able to access CMK configuration wizard through the web interface
+- **REQ-001**: System must automatically detect new account creation in KCP
+- **REQ-002**: The platform must trigger OpenKCM provisioning without user intervention
+- **REQ-003**: Krypton must be automatically configured and integrated
+- **REQ-004**: User must receive clear notification when OpenKCM is ready
+- **REQ-005**: OpenKCM must become accessible once provisioning completes
+- **REQ-006**: User must be able to access key configuration through OpenKCM
 
 #### For Customer-Managed Key Configuration:
-- **REQ-007**: User must be able to configure CMK through the CMK UI without technical expertise
-- **REQ-008**: CMK Service must coordinate seamlessly with backend Crypto Service
+- **REQ-007**: User must be able to configure CMK through OpenKCM without technical expertise
+- **REQ-008**: OpenKCM must coordinate seamlessly with Krypton
 - **REQ-009**: System must validate external key store connectivity before activation
 - **REQ-010**: Rollback capability must be available if configuration fails
-- **REQ-011**: Key configuration changes must propagate to Crypto Service automatically
+- **REQ-011**: Key configuration changes must propagate to Krypton automatically
 - **REQ-012**: Configuration status must be visible to the user throughout the process
 
 #### For External Key Store Integration:
@@ -99,39 +99,31 @@ As a Platform User, I need to enable OpenKCM encryption services for my account/
 
 #### Performance:
 - **REQ-019**: Provisioning must complete within 5 minutes for standard setup
-- **REQ-020**: CSEK to CMK migration must not cause application downtime
+- **REQ-020**: Key configuration changes must not cause application downtime
 - **REQ-021**: External key store validation must complete within 30 seconds
 - **REQ-022**: Configuration changes must propagate to all regions within 2 minutes
 
 #### Security:
 - **REQ-023**: All external key store credentials must be encrypted at rest
-- **REQ-024**: Integration must use least-privilege access principles  
+- **REQ-024**: Integration must use least-privilege access principles
 - **REQ-025**: All configuration actions must be logged for audit
 - **REQ-026**: Multi-factor authentication required for HYOK setup
 - **REQ-027**: Network connections to external systems must be encrypted
 
 #### Reliability:
 - **REQ-028**: Provisioning failures must be automatically retried
-- **REQ-029**: Partial failures must not leave tenant in inconsistent state
+- **REQ-029**: Partial failures must not leave account in inconsistent state
 - **REQ-030**: External key store outages must not prevent data access
 - **REQ-031**: Configuration must be backed up and recoverable
 
 ## Acceptance Criteria
 
 ### Successful Provisioning:
-- ✅ New tenant automatically triggers OpenKCM setup
-- ✅ User receives email notification when setup is complete
-- ✅ OpenKCM UI is accessible within 5 minutes of account creation
-- ✅ Default CSEK encryption is active immediately
+- ✅ New account automatically triggers OpenKCM setup
+- ✅ User receives notification when setup is complete
+- ✅ OpenKCM is accessible within 5 minutes of account creation
 - ✅ Configuration wizard guides user through setup options
 
-### Successful CSEK to CMK Migration:
-- ✅ User can initiate migration through UI without technical knowledge
-- ✅ All existing data is re-encrypted with new key hierarchy
-- ✅ Applications continue working without modification during migration
-- ✅ User receives confirmation when migration is complete
-- ✅ Key management dashboard shows new CMK status
-
 ### Successful External Key Store Integration:
 - ✅ User can connect to AWS KMS, Azure Key Vault, or GCP KMS
 - ✅ System validates permissions and connectivity before activation
@@ -142,14 +134,13 @@ As a Platform User, I need to enable OpenKCM encryption services for my account/
 ### Error Scenarios:
 - ❌ If provisioning fails → Automatic retry with user notification
 - ❌ If external key store is unreachable → Clear error with resolution steps
-- ❌ If migration fails → Automatic rollback to previous state
+- ❌ If configuration fails → Automatic rollback to previous state
 - ❌ If permissions are insufficient → Detailed permission requirements shown
 
 ## Business Value
 
 ### For Platform Users:
 - **Zero-Touch Setup**: Automatic provisioning when creating new accounts
-- **Gradual Adoption**: Start with default encryption, upgrade when ready
 - **Compliance Ready**: Easy path to meet regulatory requirements
 - **Vendor Flexibility**: Use any supported key management system
 - **Data Sovereignty**: Full control over encryption keys and data access
@@ -163,8 +154,8 @@ As a Platform User, I need to enable OpenKCM encryption services for my account/
 
 ## Integration Dependencies
 
-### Platform Mesh Requirements:
-- **Tenant Lifecycle Events**: Detection of account/tenant creation and deletion
+### Platform Requirements:
+- **Account Lifecycle Events**: Detection of account creation and deletion
 - **Service Discovery**: Registration of OpenKCM services in mesh
 - **Network Policies**: Secure communication between services
 - **Resource Management**: CPU, memory, and storage provisioning
@@ -173,4 +164,4 @@ As a Platform User, I need to enable OpenKCM encryption services for my account/
 - **Cloud KMS APIs**: Integration with AWS, Azure, GCP key management
 - **HSM Connectivity**: PKCS#11 and proprietary HSM interfaces
 - **Identity Integration**: SSO and authentication with existing systems
-- **Monitoring Integration**: Health checks and alerting for key services
+- **Monitoring Integration**: Health checks and alerting for key services

docs/use-cases/002-L1-Key-Actions.md

@@ -1,14 +1,15 @@
 ---
 authors:
-  - Aysan Mazloumi
+  - Aysan
+last_updated: 2026-07-15
 ---
 
 ## Persona
-**Platform Users** - Anyone with access to an account in KCP who enables OpenKCM via Platform Mesh and accesses the OpenKCM UI for management of the keychain (e.g., switching from CSEK to CMK with HYOK or BYOK). These users interact with the CMK Layer of OpenKCM to configure and manage their customer-managed encryption keys.
+**Platform Users** - Anyone with access to an account in a platform who enables OpenKCM and uses it to manage the keychain (e.g., switching from CSEK to CMK with HYOK or BYOK). These users interact with OpenKCM to configure and manage their customer-managed encryption keys.
 
 ## Overview
 
-As a Platform User, I need to control my encryption keys to maintain data security and compliance. L1 key actions allow me to manage the lifecycle of my Customer Master Keys through the OpenKCM UI.
+As a Platform User, I need to control my encryption keys to maintain data security and compliance. L1 key actions allow me to manage the lifecycle of my Customer Master Keys through OpenKCM.
 
 ## User Stories
 
@@ -18,7 +19,7 @@ As a Platform User, I need to control my encryption keys to maintain data securi
 **So that** my applications can both encrypt new data and decrypt existing data  
 
 **User Journey:**
-1. I log into the OpenKCM UI through my KCP account
+1. I log into OpenKCM through my KCP account
 2. I navigate to my key management dashboard
 3. I select my L1 key and click "Enable"
 4. I receive confirmation that encryption and decryption operations are now active
@@ -30,7 +31,7 @@ As a Platform User, I need to control my encryption keys to maintain data securi
 **So that** I can prevent new data encryption while still accessing existing data  
 
 **User Journey:**
-1. I access the OpenKCM UI and go to key management
+1. I access OpenKCM and go to key management
 2. I select my active L1 key and click "Disable"
 3. I confirm the action understanding it will stop new encryption
 4. I receive confirmation that the key is now in read-only mode