The Edge Layer Execution Model: Layered Responders And The No-Invalid-Request Principle
Summary
The execution model: CloudFront Functions as the sub-millisecond quick decision point (no I/O, embedded data only), Lambda@Edge as the capable layer, and an async third layer off the hot path — first responder, second responder, third responder. Two principles anchor it. No invalid request should reach the server: because we control both client and server we know exactly what valid traffic looks like, so the edge allowlists rather than denylists. And the edge should be hostile to our own applications too — an own-app request that doesn't match the valid profile is a bug, caught at the edge like an attack would be.
Key concepts
- The layered responders — push each decision to the fastest, cheapest layer that can make it
- No invalid request — allowlist, not denylist — the posture inversion
- Not everything has to be online — respond within a period of time, not instantly — what makes Layer 3 viable
- The symmetry principle — deploying an endpoint updates the edge; the profile is a deploy artefact
Key ideas
- "Slow analysis, fast enforcement" — the phrase the whole architecture answers to.
- The cache-hit versus cache-miss distinction is a controllable lever, and later a tabletop gap.
- Hostility to our own traffic turns the edge into a correctness check as well as a security check.
On this site
The three-layer model on the front page and architecture page descends from this brief, with L1's role later corrected to decide-and-signal only.