Asynchronous supervision for sovereign cloud platforms

A method comprising:

• at one or more processors executing a secure sovereign manager that controls remote execution of commands on a sovereign cloud computing platform:
• creating an escorted session for an unqualified user for invoking commands on the sovereign cloud computing platform, wherein the unqualified user does not have sovereign-trusted credentials that define qualifications required for accessing the sovereign cloud computing platform, and wherein the escorted session is asynchronously supervised by a qualified user that has sovereign-trusted credentials;
• receiving a command from the unqualified user in the escorted session;
• processing the received command using a compliance analyzer to programmatically determine whether to present the received command for review by the qualified user supervising the escorted session, wherein:
• the compliance analyzer includes a curated list of forbidden commands;
• and
• programmatically determining whether to present the received command for review by the qualified user supervising the escorted session includes determining whether the received command is included in the curated list of forbidden commands;
• and
• based at least in part on a determination of whether to present the received command for review:
• (a) determining that the received command will not be presented for review by the qualified user supervising the escorted session, preventing invocation of the received command, and sending an error message to the unqualified user;
• or
• (b) asynchronously presenting the received command to the qualified user,
• receiving an indication of approval or denial of invocation of the received command from the qualified user, and
• (b1) based on at least receiving an indication of approval, invoking the received command on the sovereign cloud computing platform;
• or
• (b2) based on at least receiving an indication of denial, preventing invocation of the received command and send an error message to the unqualified user.

A computer system comprising:

• one or more processors configured to execute a secure sovereign manager that controls remote execution of commands on a sovereign cloud computing platform that is controlled by a government entity of a sovereign nation, wherein the secure sovereign manager is configured to:
• create an escorted session for an unqualified user for invoking commands on the sovereign cloud computing platform, wherein the unqualified user does not have sovereign-trusted credentials that define qualifications required for accessing the sovereign cloud computing platform, wherein the escorted session is asynchronously supervised by a qualified user that has sovereign-trusted credentials, and wherein the sovereign-trusted credentials include one or more of a citizenship and a security clearance for the government entity of the sovereign nation;
• receive a command from the unqualified user in the escorted session;
• process the received command using a compliance analyzer to programmatically determine whether to present the received command for review by the qualified user supervising the escorted session, wherein:
• the compliance analyzer includes a curated list of forbidden commands;
• and
• to programmatically determine whether to present the received command for review by the qualified user supervising the escorted session, the compliance analyzer is configured at least to determine whether the received command is included in the curated list of forbidden commands;
• and
• based at least in part on a determination of whether to present the received command for review:
• (a) determine that the received command will not be presented for review by the qualified user supervising the escorted session, prevent invocation of the received command, and send an error message to the unqualified user;
• or
• (b) asynchronously present the received command to the qualified user
• receive an indication of approval or denial of invocation of the received command from the qualified user, and
• (b1) based on at least receiving an indication of approval, invoke the received command on the sovereign cloud computing platform;
• or
• (b2) based on at least receiving an indication of denial, prevent invocation of the received command and send an error message to the unqualified user.