Next film, 2 min 16 s
A vendor's product runs in our estate and in theirs. Is that one identity or two?
- Film
- Same software, many environments
Films · Journey 2
What lets an authorisation server trust an agent it meets for the first time?
Chapters 10
Transcript, read from the captions
Ralph Bragg
Hi, I'm Ralph from Raidiam. Every platform you run needs a record for every caller. That's a lot of copies to keep in sync across your estate. Let me show you a different way.
The grid
Here is an objection I hear a lot. Every platform you run keeps a list of what it admits. Add an agent, and somebody registers it on every platform it calls. A credential on each. A record to keep current on each. The bill does not come with the first agent. It comes with the twentieth. What does a platform hold today?
What a platform holds today
Let me show you. We built this authorisation platform as a reference implementation. It is not Raidiam Connect. It stands in for one you already run. Before it admits any caller, it looks in its own client database. See what that database holds.
An agent it has never met
The platform searches that same database for this agent. The answer comes back not found. So the platform asks a different question. Not do I know you, but who vouches for you?
What it holds instead
The platform does not hold that answer. The authority that governs the agent has it, and any platform can ask. Every platform reads the same answer. So each platform keeps one relationship with that authority, instead of one with every agent.
Where that relationship sits
So where does that relationship sit? Here, in Connect. An authority grants an organisation its domains and roles once. The authority decides. We give it the tools to govern. Connect publishes those roles as signed statements, and keeps them current. Any platform checks that answer itself. It asks nobody's permission. But does it work against a running platform?
Admitted, with no record
A real run, on synthetic records. The platform held no client record for this agent, checked who vouches for it, and issued a token.
The platform says the same
What does the platform say? The same thing. This is its own log, with the entities it already trusts at the top. Every signature on that walk reads verified. The agent was admitted under an identity the authority governs.
Govern the agent once
Nothing was registered. No credential went out for anyone to hold. There is no record to keep current or remove. And if you need to end it? Withdraw the agent at its authority. Each platform stops admitting it when the signed answer it holds expires. Govern the agent once. Every boundary it crosses gets the same signed answer.
Book a working session
No client record, and nothing to keep in sync. If this is a problem you're facing, I'd be glad to talk you through it.
The use case
Resolved, not registered.
A platform meeting the agent for the first time admits it by resolving the authority, issues a token bounded by three ceilings, and the resource acts on it.