Trust anchored below the operating system: write-protect enforcement, monotonic counters, and isolated compliance clocks.
Governance implemented purely in host software shares the fate of the host. An administrator, a compromised process, or a privileged adversary can reverse a policy decision, alter a retention attribute, or rewrite a record, and the same software that enforced the rule is responsible for reporting the violation.
Our research examines what changes when enforcement is moved beneath the operating system, into the storage subsystem itself, so that a policy outcome is a physical property of the device rather than a convention observed by the host.
Three anchors recur across our work. A hardware write-protect path can make a retention decision physically binding rather than administratively binding. A monotonic counter provides a time-ordering that cannot be rolled back by resetting a system clock. And an isolated compliance clock provides trusted time in environments with no network and no external time source.
Together these allow a retention or immutability guarantee to survive precisely the adversary that software-only approaches assume away: one who holds legitimate administrative credentials.
We distinguish carefully between attribute-level protection and hardware-enforced immutability. Marking a file read-only is a useful control, but it is reversible by a sufficiently privileged party. Genuine write-once retention requires either a storage platform that enforces it independently or a controller that owns the physical write-enable path.
Our published architecture states which guarantee applies in which configuration, because conflating the two is the most common way immutability claims become untrue.
Retention decisions bound to the physical program-enable path.
Non-rollback ordering independent of host time.
Trusted time without network dependence.
Key custody, signing, and attestation beneath the host.