Sovereignty without administrators.
Classified material opens only on attested hardware, under t-of-n quorum, inside the window policy allows. There is no administrator who can override the math, and every access lands in a tamper-evident chain.
Classified systems still concentrate trust in administrators, and the people with root access are the threat model. Insider exfiltration, coerced operators, and harvest-now, decrypt-later collection all exploit the same fact: somewhere a key exists and someone holds it.
SCSA removes that somewhere. Capability is split across independent parties, derived from attested hardware at access time, and gated by policy windows enforced by sequential computation. Compartments map to quorums, declassification dates map to time-lock maturities, and every access lands in a chain that cannot be silently edited.
No root key, no operator override
Capability is split t-of-n across independent parties and derived from hardware at access time. There is no administrator account for an insider to turn.
Quorum release for compartmented data
A threshold of command holders must approve within the policy window. Approvals are signed, logged, and verifiable after the fact.
Post-quantum cryptography throughout
ML-DSA-65 hybrid signatures and ML-KEM-768 encapsulation, aligned to FIPS 203/204, protect material against harvest-now, decrypt-later adversaries.
Sovereignty stops depending on personnel and starts depending on physics.