Explore the Trust Boundary
Exercise 1: Explore the Trust Boundary (~10 min)
Goal: Understand where the trust boundary lies — what data stays inside, what may cross it, and what trade-offs exist.
Conceptual Framing (2 min)
What is a trust boundary? The line between what you control and what you don’t.
In a regulated enterprise, you need to know:
- Where does your code live?
- Where does your metadata live?
- What data can cross the boundary — and under what conditions?
Steps
Step 1. Clone the organization-owned repository to your local machine:
git clone https://YOUR-ENTERPRISE.ghe.com/trust-boundary-workshop/trust-boundary-demo.git
cd trust-boundary-demo
Step 2. Navigate to Organization settings → Data Residency and confirm Japan-region enforcement is active.
Step 3. Fill in the Data Residency Checklist — open docs/data-residency-checklist.md and record your observations:
| Category | Data | Residency Status |
|---|---|---|
| ✅ Inside region | Source code (Git repositories) | Stored in Japan |
| ✅ Inside region | Issues, pull requests, discussions | Stored in Japan |
| ✅ Inside region | Wikis | Stored in Japan |
| ✅ Inside region | User profile data (EMU-managed) | Stored in Japan |
| ✅ Inside region | GitHub Actions logs & artifacts | Stored in Japan |
| ⚠️ May leave region | Copilot telemetry & usage logs | Processed by Copilot service |
| ⚠️ May leave region | Billing & support data | Managed globally |
| ⚠️ May leave region | Secret scanning validity checks | External service validation |
Step 4. Note GHE.com differences — open docs/ghe-com-comparison.md and fill in your observations:
| Aspect | GitHub.com | GHE.com (Data Residency) |
|---|---|---|
| URL | github.com/org/repo |
ENTERPRISE.ghe.com/org/repo |
| API endpoint | api.github.com |
api.ENTERPRISE.ghe.com |
| Public repos | ✅ Available | ❌ Not available |
| GitHub Marketplace | ✅ Available | ⚠️ Limited |
| Gists | ✅ Available | ❌ Not available |
| GitHub Pages (public) | ✅ Available | ❌ Not available |
| GitHub Sponsors | ✅ Available | ❌ Not available |
| Discussions | ✅ Available | Check availability |
Step 5. As an EMU user, attempt to create a personal repository and push code:
# This should fail — EMU accounts cannot create repos outside the enterprise
gh repo create my-personal-project --private
Observe: The operation is blocked. EMU accounts can only operate within the enterprise boundary.
Expected Outcome
Participants can articulate what data is inside vs. outside the trust boundary and understand the trade-offs of Data Residency.
Tip: Run
scripts/verify-exercise1.shto validate your Exercise 1 completion.
./scripts/verify-exercise1.sh
Key Insight
“Data Residency doesn’t mean ALL data stays in Japan. It means you’ve made a conscious decision about where the trust boundary is — and you understand what crosses it.”
NIST SSDF PO.1 requires organizations to “define security requirements for their development infrastructure.” Data Residency is how GitHub Enterprise delivers on this requirement — by giving organizations control over where their development data resides.