ArchitectureThe decision path
Your systems decide, inside your infrastructure. Raidiam Connect publishes what they read.
Raidiam Connect holds one governed record for each agent and publishes it as signed statements. Your systems read those statements, verify them against anchors they pin, and make the decision themselves. Connect answers the reads and is never asked for the decision.
Raidiam Connect
One governed record for each agent, published as signed statements.
- Governed records
- Authority and policy
- Trust marks
- Signed statements
Answers reads at federation.
Each decision point reads Connect answers with signed statements
Your estate
Authorisation server
Workforce platform
Tarnbrook Platforms
- Pins the anchors of
- Tarnbrook Financial Group, and Aldercross Scheme Authority for trust marks
- Requires the trust mark
- tarnbrook.
agent. member - Reads Connect again
- Within 60 s, on its next request
- Signing key
- Generated by the setup tool. Connect certifies the public half.
Decides here
API gateway
Tarnbrook platform edge
Tarnbrook Platforms
- Pins the anchor of
- Tarnbrook Financial Group
- Requires
- A DPoP bound token from a server its chain allows
- Reads Connect again
- Every 60 s, in the background
- Signing key
- Generated by the setup tool. Connect certifies the public half.
Decides here
MCP resource
Records resource
Tarnbrook Platforms
- Pins the anchor of
- Tarnbrook Financial Group
- Requires
- A token from the API platform
- Reads Connect again
- Within 300 s, on its next request
- Signing key
- Generated by its holder. Connect publishes the public half.
Decides here
A partner's estate
Authorisation server
Larkspur gateway
Larkspur Partners
- Pins the anchor of
- Aldercross Scheme Authority
- Requires the trust mark
- aldercross.
accredited. agent - Reads Connect again
- Within 60 s, on its next request
- Signing key
- Generated by the setup tool. Connect certifies the public half.
Decides here
Each decision point asks Connect for
- Authority and anchor configurations
- Subordinate statements
- Subordinate listings
- Trust mark status
So Connect sees
- Which agent is resolved, and when
From the agent's own host
- Its entity configuration, unless Connect hosts it
Stays with each decision point
- The decision
- The anchors it pins
Held by Raidiam on this tenant
- The anchor and authority signing keys
- The signing key of each hosted agent's configuration
A platform decides on answers it already holds, until the window it set expires. An unresolved agent waits.
On this showcase Raidiam operates both sides, from one deployment manifest. It declares no storage region and no cloud provider.
What this gives you
-
Decides where it runs
Each decision point verifies the statements and makes the decision itself.
-
Pinned by you
Each decision point pins its anchors in its own configuration.
-
Your platforms stay
Each one adds three checks and accepts attest_jwt_client_auth from an attested agent.
-
Open standards
OpenID Federation 1.0, OAuth 2.0, X.509 and mTLS, SPIFFE.
The strings a platform implements
Client authentication, the Workforce platform and API platform
- private_key_jwt
- attest_jwt_client_auth
Grants, the API platform
- client_credentials
- urn:openid:params:grant-type:ciba
- urn:ietf:params:oauth:grant-type:token-exchange
Attestation format, the Tarnbrook attester
- oauth-client-attestation+jwt
Evidence kinds the Tarnbrook attester verifies
- spiffe-x509-svid
- operator-enrolment
- tpm-key-certification
Go deeper
- Runs anywhereOne governed identity on a workstation, a workload or a publisher's platform.
- Keys and custodyWho generates every private key, who holds it, and what Connect publishes.
- DeploymentWhat Raidiam operates, what you operate, and the boundary between them.
- The live estateEvery entity on that page is read from an authority when you open it.
Which system in your estate would you want to decide about an agent it is meeting for the first time?
Ninety minutes, on the shape of your estate: which systems resolve first, which anchor each pins, and which key each party holds.