ArchitectureRuntime
The runtime changes the assurance. The governance stays the same.
Four runtimes, one governed identity. What changes is the evidence a platform gets about the running instance.
Above all four
Raidiam Connect
One governed identity, one envelope, one chain to one anchor. Connect runs none of the four.
-
A cloud workload
The Batch Reviewer, three instances.
- In the token
- attested
- Authenticates
- attest_jwt_client_auth
- Listed by
- The Tarnbrook authority.
-
A managed workstation
The Analyst Companion, one instance.
- In the token
- asserted
- Authenticates
- attest_jwt_client_auth
- Listed by
- The Tarnbrook authority.
-
A service you operate
The Records Assistant and Tarnbrook's Balance Monitor.
- In the token
- absent
- Authenticates
- private_key_jwt
- Listed by
- The Tarnbrook authority.
-
A publisher's platform
Quillon's Balance Monitor and Larkspur's Holdings Reader.
- In the token
- absent
- Authenticates
- private_key_jwt
- Listed by
- A root Tarnbrook recognises.
What attested lets a platform do that asserted does not
On a workload the attester cuts nothing, so the agent's envelope is the only limit. A workstation instance with a hardware bound key also carries the word attested, and is still held below moving value.
What the platform may issue
-
records.readRead records from named collections. Kept Withheld Outside its envelope -
records.annotateWrite a note on a record. Moves nothing. Kept Withheld Outside its envelope -
transfer.statusRead the status of a transfer. Kept Withheld Outside its envelope -
transfer.initiateMove value between accounts under a ceiling. Kept Withheld Outside its envelope -
review.submitAsk another agent to review a batch of records. Kept Withheld Outside its envelope
In the token
attested
Runs this way
The Batch Reviewer.
Why the cut
Nothing is withheld. The registered envelope is the only limit.
One attestation lasts
3600 seconds
In the token
asserted
Runs this way
The Analyst Companion.
Why the cut
This copy runs on a workstation. The attester has a key, an enrolled person and a claimed release, and no evidence about the machine or the binary. It is held to reading records.
One attestation lasts
3600 seconds
In the token
attested
Not switched on in this tenant. The attester holds no device root to check a hardware key certification against.
Why the cut
This copy runs on a workstation with a hardware bound key. The attester can vouch that the key cannot leave the device and cannot vouch for the software or the device posture, so it is held below initiating a transfer and below asking another agent to act.
One attestation lasts
3600 seconds
The attester publishes what it accepts: two hosting kinds, one required evidence kind for each, a hardware key certification as optional on a workstation, and no device root. Read at 02:44 UTC on 16 September 2026. Observed
One governed identity, whatever it runs on.
- One governed identity One federation entity, one identifier, one key set. Connect signs it, or you publish your own.
- One chain to one anchor Every platform walks the same statements to the key it pins.
- One registered envelope The authority sets what the agent may ask for, whichever runtime asks.
- One lifecycle Withdraw the identity once. Every runtime sees it at its next resolve.
Where do your agents run today?
Ninety minutes, on the shape of your estate: which systems resolve first, which anchor each pins, and which key each party holds.