CTN Implementation Roadmap

Phased approach for Connected Trade Network deployment

Status note (2026-05-29): the roadmap below reflects the agreed phasing. Phase 1 (CTN Core — ASR + endpoint registration + Visibility) is in progress. Per-component delivery status is tracked outside this document.

This is the only document in the architecture set where Orchestration Register, VOD, dual-token validation, OPA, and 2R+ are described. All other chapters scope themselves to the 2026 delivery only. The design notes for the deferred components are parked in docs/_out-of-scope-2026/ (gitignored) and will be brought back into the repository when the corresponding phase starts.

Overview

The Connected Trade Network follows the BDI Reference Architecture roadmap with a pragmatic, phased approach. CTN prioritizes simplicity and rapid deployment, starting with hosted OAuth services to avoid initial X.509 certificate complexity.

Release Strategy

CTN is delivered as a phased rollout. The 2026 baseline is deliberately narrow — it covers the Association Register, endpoint registration and the first use case (“Visibility Achterland Containerlogistiek”) so participants can start exchanging operational data without waiting for heavier components. Later phases add the Orchestration Register, dossier-level authorisation and full PKI federation.

• Phase 1 (v1.0) — ASR baseline (2026): Association Register + endpoint registration + VAD-only local authorisation at the data provider.
• Phase 2 (v1.1) — Orchestration Register + dual-token (opt-in): Orchestration Register, VOD, OPA-based PDP, dual-token validation.
• Phase 3 (v2.x): enhanced trust and compliance, broader provider integration.
• Future (v3.0): full PKI, federation across associations.

---

Phase 1: CTN v1.0 — ASR baseline (2026)

Target: Operational MVP on the VAD-only baseline.

Scope

Establish the minimum infrastructure that lets participants exchange public-data flows (CODECO gate-in/gate-out events, container numbers, ETAs, master B/L metadata) under verifiable participation. No Orchestration Register and no VOD in this phase.

Components

Association Register (ASR)

• Authentication: Self-hosted Keycloak with outward federation (Entra ID / eHerkenning / local accounts) — see ADR-00002, ADR-00008
• Onboarding: Manual process with form-based registration
• Verification: Basic KvK/LEI lookup (manual review)
• Token Generation: VAD tokens via OAuth provider
• Data Store: PostgreSQL with participant records

Local authorisation at the data provider

• Authorisation: each data provider validates VAD claims and applies its own policy; no central PDP in 2026.
• Token Validation: VAD signature + claims.
• Data Access: provider-defined data sets per requester tier.

BDI Connector

• Function: Basic API gateway/proxy
• Authentication: OAuth M2M client credentials
• Communication: TLS 1.3 only
• Integration: REST APIs with OpenAPI specs

Simplifications for v1.0

✅ What’s Included:

• Hosted OAuth provider (no certificate management)
• VAD-only authorisation
• Whitelist-based policy
• Manual onboarding process
• Email-based notifications
• Single association support

❌ What’s Deferred to Phase 2 (see docs/_out-of-scope-2026/):

• Orchestration Register
• VOD token generation
• Dual-token validation (VAD + VOD)
• Per-dossier party enrolment
• Delegation chains

❌ What’s Deferred to later phases:

• X.509 certificate generation, ACME protocol
• Automated compliance checks
• Event broker integration (Event Grid / EventBridge / Pulsar)
• Multi-association support
• OPA policy engine
• DNS validation

Success Criteria

• 10+ organisations onboarded
• VAD-only flow live for at least one public-data use case (e.g. CODECO subscription)
• <1s authorisation decisions
• 99% uptime for core services

---

Phase 2: CTN v1.1 — Add Orchestration Register + Dual-Token (opt-in)

Target: Add the Orchestration Register and dual-token validation for sensitive transports — opt-in per data provider and per dossier. Brings back the design notes currently parked in docs/_out-of-scope-2026/.

Enhancements

Orchestration Register (new component, opt-in)

• Dossier management for participating orchestrators
• Excel-driven party enrolment (50+ parties per dossier)
• VOD issuance (no delegation chains yet)
• Subcontractor delegation pattern (limited)
• Bring back _out-of-scope-2026/ctn-portal-query-federation.md and the fuzzy-search component for party discovery within dossiers.

Event-Driven Architecture

• Event-broker integration (Azure Event Grid as reference; AWS EventBridge / Apache Pulsar / Kafka as alternatives)
• Webhook notifications
• Basic event replay capability

Enhanced Authorisation (Local Policy Engine + OPA)

• Re-introduce the Local Policy Engine and OPA-based six-flow model from _out-of-scope-2026/ctn-authorization-model.md and _out-of-scope-2026/ctn-open-policy-agent-implementation.md.
• Dual-token (VAD + VOD) validation path, active for opt-in providers / dossiers.
• Re-introduce _out-of-scope-2026/ctn-token-architecture.md (rewritten with VOD details) and _out-of-scope-2026/ctn-three-tier-authentication.md for the delegation tiers.
• Role-based access patterns; basic data-minimisation rules.

Operational Improvements

• Automated monitoring and alerting
• Self-service participant portal
• API rate limiting and throttling

New Capabilities

• DNS validation as alternative authentication
• Multiple orchestrator support
• Basic semantic mapping
• Standardized data sets

---

Phase 3: CTN v2.0 - Trust & Compliance (Q1-Q2 2027)

Target: Enterprise-grade with regulatory compliance

Major Additions

Component Registry

• Centralized service discovery
• Trust list synchronization
• Provider validation

Enhanced Security

• Business assurance tokens with claims
• Signed orchestration evidence
• JWKS endpoints for key distribution

Regulatory Integration

• Authority access patterns
• Compliance data sets
• Audit trail requirements
• GDPR automation

Advanced Features

• Caching strategies
• Performance optimization
• Multi-region deployment
• Disaster recovery

Trust Framework

• Association trust lists
• Component verification
• Cross-association interoperability

---

Phase 4: CTN v2.1 - Federation (Q3-Q4 2027)

Target: Federated operations across associations

Capabilities

• Multi-association membership
• Federated trust model
• Enhanced token validation
• Cross-border operations

Security Enhancements

• Protection against social engineering
• Advanced threat detection
• Automated compliance verification

---

Future: CTN v3.0 - Full PKI (2027+)

Target: Complete self-sovereignty with PKI

Full PKI Implementation

• BDI X.509 certificate authority
• ACME protocol support
• Automated key rotation
• Self-signed certificate ecosystem

Advanced Capabilities

• Event broker integration (Pulsar/Kafka)
• Blockchain evidence trails
• AI-powered authorization
• Predictive analytics

---

Implementation Principles

For v1.0 Release

1. Simplicity First: Use hosted services where possible
2. Manual Processes OK: Automation can come later
3. Proven Technology: OAuth over X.509 initially
4. Minimal Viable Security: Whitelists before complex policies
5. Quick Wins: Focus on immediate business value

Technical Decisions by Version

v1.0 - Foundational Decisions

Component	Complex Option	v1.0 Simple Choice
Authentication	X.509 certificates per participant	Self-hosted Keycloak (OAuth 2.0 / OIDC)
Authorization	OPA with Rego	Simple whitelists
Events	Event Grid + Webhooks	Email notifications
Onboarding	Automated verification	Manual review
Certificates	ACME protocol	OAuth tokens only
Delegation	Chain validation	Single level only
Trust Model	Business assurance tokens	Identity-based whitelisting

Migration Path

Each phase builds on the previous:

v1.0 (Foundation) → v1.1 (Multi-Association) → v2.0 (Trust Lists) → v2.1 (Federation) → v2.2 (Event Brokers) → v3.0 (Full PKI)

No breaking changes between versions - only additive improvements.

---

Risk Mitigation for Simplified v1.0

Risk	Mitigation
OAuth provider dependency	Choose enterprise provider with SLA
Manual processes don’t scale	Plan automation for v1.1
Limited security model	Sufficient for pilot phase
No delegation support	Document workarounds
Email notification delays	Acceptable for initial scale

---

Success Metrics by Phase

v1.0 Metrics (Foundation)

• Time to onboard: <24 hours
• Authorization latency: <1 second
• System availability: 99%
• Participant satisfaction: >80%

v1.1 Metrics (Scaling)

• Parties per dossier: 50+
• Events processed: 1000/minute
• API calls: 100/second
• Automated processes: 50%

v2.0 Metrics (Trust)

• Compliance automation: 90%
• Cross-association ops: Enabled
• Security incidents: <1/month
• Audit compliance: 100%

v2.2 Metrics (Event Brokers)

• Event throughput: 10,000/second
• Message delivery: 99.99%
• Event replay time: <5 minutes
• Broker availability: 99.95%

---