The web interface accepts a batch of files, runs all applicable rules for the detected format and binding approach, and returns a per-file verdict — COMPLIANT or NON-COMPLIANT — with every finding linked to the normative requirement it maps to.
Tessera Validator
ADatP-4774 · ADatP-4778 · ADatP-5636 — upload labelled files and get a per-rule compliance report mapped to the specific spec section that defines each requirement.
The web interface accepts a batch of files, runs all applicable rules for the detected format and binding approach, and returns a per-file verdict — COMPLIANT or NON-COMPLIANT — with every finding linked to the normative requirement it maps to.
80+ rules across four standards, covering structure, binding, and cryptography.
Required XML elements, PolicyIdentifier, classification level and
category values, originator, CreationDateTime format. Validated
against both the XML schema and the normative SHALL/SHALL NOT requirements.
BDO structure, binding approach, JWS compact serialization format,
protected header fields (alg, cty), payload
decodability, granularity rules, XMP storage profile compliance.
Catches bindings that are structurally valid but non-conformant with
the normative profiles.
XML-DSIG digest and signature verification, algorithm compliance —
MD5, SHA-1, DSA-SHA1, RSA-MD5 flagged as prohibited — KeyInfo
requirements, and X.509 certificate chain validation against a user-provided
trust anchor.
Required metadata elements, PointOfContact, Code,
DCMIType, datetime format compliance. Validated against the
NATO Core Metadata Specification normative requirements.
The validator detects the format and binding approach from the file itself and applies the rules appropriate for that combination.
.docx, .xlsx, .pptx with embedded BDO in customXml.bdo sidecar or detached binding files.bdoj JWS-based binding objectsThe validator is also available as a CLI for scripting and CI pipelines. It accepts the same file formats and produces the same rule-mapped output in console, JSON, or HTML format.
tessera validate *.docx samples/*.bdo
tessera validate file.docx --output json --output-file results.json
tessera validate file.docx --trust-anchor root_ca.pem
tessera list-rules
The CLI is included in the self-hosted deployment. Contact us if you need access to it on an isolated network.
A hosted instance is available at validator.tessera-solutions.eu. Access is open to nationals from FMN Affiliate nations working with the NATO metadata labelling standards.
If you are working on an isolated or classified network where the hosted instance is not reachable, the validator can be deployed locally. Get in touch to discuss your situation.