---
type: concept
tags: [parking, architecture, security, decision]
sources: [parking-system-architecture]
updated: 2026-06-14
---

# The Core Fork: Where Is the Trust Boundary?

The pivotal device-layer decision. Two valid architectures, **chosen per deployment and mixable
per lane**. (See [[parking-system-architecture]] §5.)

| Trust boundary | Approach | Property |
| --- | --- | --- |
| **= the network** | Off-the-shelf controller ([[uhppote-controller]]/ZKTeco), contained by [[network-isolation]] | **Auditable** — tamper-evident, you don't own firmware |
| **= the device** | Custom controller whose firmware enforces auth ([[esp32-custom-controller]]) | **Unforgeable** — but you own the firmware |

This is the detection-vs-prevention choice. With the UHPPOTE path, trustworthiness comes from
[[event-log-ingestion]] + the [[append-only-event-chain]]. With the ESP32 path, it comes from
[[challenge-response-auth]]. See [[uhppote-vs-esp32]] for the head-to-head.