Scenario: I have an application A which holds sensitive data. I have an application B which needs to process the data. A will provide a web-interface. B will make calls to get required data from A.
Requirement: I would like to secure the system such that A transfers data only to actual instances of B. As far as possible I would like to prevent any human from being able to make a call to A, pretending to be B
Solutions Considered: This question came closest to my needs: How to make secure communication between servers However, it involves storing some information on the client (shared secret, certificate, public/private key) either hardcoded or saved somewhere on the server. While this prevents external parties from attacking the system, admins or devs for service B will have access to these "secrets", and will be able to fake a call from B.
Question: Is it at all possible to implement an application authentication scheme that even devs / admins cannot fake? I am open to solutions that involve procedural controls, separation of responsibilities and other techniques in conjunction with software / cryptographic controls