Confidential computing uses hardware-backed isolation to protect a workload while it runs, even from parts of the infrastructure operating it, such as the cloud provider's hypervisor. But running inside a confidential virtual machine is only the start. Someone must decide which software to trust, verify evidence about it, release secrets safely, and keep those guarantees intact through updates and failures.
The key mechanism is remote attestation: the hardware produces signed evidence of what was launched, and a verifier decides whether to trust it. Attestation supports a trust decision; it does not by itself prove an application is safe. The IETF's attestation architecture, RFC 9334, is a good conceptual starting point for every topic in this theme.
Topic 1: Beyond "the VM is confidential": verifying the application before releasing secrets
The question. How can a data owner verify the application and its configuration, not merely that confidential-computing hardware is present?
What you'll do.
- Build one demonstrator that links hardware evidence, measured boot, an authenticated OS image and the application's identity to a secret-release policy.
- Test it against modified images, altered configurations and outdated versions.
Topic 2: Updating confidential workloads without weakening trust
The question. How can attestation policies accept legitimate security updates while rejecting vulnerable or unauthorised versions? Pinning one exact measurement is simple, until the software needs patching.
What you'll do.
- Prototype a policy-update workflow for one immutable guest image.
Topic 3: What makes a database genuinely confidential?
The question. When a database runs inside a confidential VM, which paths can still expose its data? Isolating the database process is not the same as protecting its whole data lifecycle.
What you'll do.
- Choose one database and examine storage keys, replication, backups, logs and administrative access.
- Implement protections for two or three of the paths you find.
Topic 4: Confidential AI agents: protecting secrets when the application can act
The question. What protection does confidential computing give when an AI agent can call tools and send data outside its protected environment? Hardware isolation protects the agent from the host, but not from itself.
What you'll do.
- Build a small agent with synthetic secrets and a controlled set of tools.
- Combine attested secret provisioning with explicit limits on tool access and outgoing data.
Topic 5: Taking the administrator out of the trust base: confidential computing for TSD
The question. Norway's national platform for sensitive research data relies on trusting its operators. Which parts of that trust could hardware guarantees replace, and at what cost to performance and usability?
What you'll do.
- Build a threat model from TSD's public system description.
- Run representative workloads in confidential VMs, such as registry statistics in R or a genomics pipeline.
- Release decryption keys only after successful attestation, using open-source tooling.