Raidiam
Book a working session

Evidence

Governance: who sets each bound

The working behind the claim: six bounded decisions, five withdrawal scopes, every control surface and the freshness bound a consumer can rely on.

Back to the claim

Six bounded decisions

Six decisions, each owned by a party you can name. Select a stage.

Publisher

Control which publishers you recognise.

A publisher signs its releases and publishes its own root. You decide whether that root becomes a subordinate of your authority.

  • Recognise a publisher's own root, or leave it unrecognised.
  • Set the ceiling on every identity that chains through that hop.
  • Stop publishing the recognition and every identity beneath it stops resolving.

On this estate Deployment evidence

Publisher
Quillon Software Limited
Trust path
The Quillon root, recognised by the Tarnbrook authority
Authority ceiling
tarnbrook.external.reader
What that role sets
authorization_details_types subset_of records.read, transfer.status
And
token_endpoint_auth_method one_of private_key_jwt

The recognition mints nothing. Quillon already publishes its own configuration at its own identifier, and the authority becomes a superior of it.

Organisation

Name the organisation that answers for the agent.

An authority binds role claims to an organisation. Every role an agent can carry comes from its operator's bindings.

  • Bind an organisation's roles at one authority, or at several.
  • Name the person accountable for each agent it operates.
  • Change a binding and every agent under it resolves differently.

On this estate Deployment evidence

Operator
Tarnbrook Financial Group Limited
Register
Showcase register, SR-100001
Bound at
The Tarnbrook authority, and the Aldercross Scheme Authority
Accountable owner
Imogen Falk, for the Records Assistant

Two organisations may operate the same release and hold different bindings. That is why the same software gets a different envelope under each.

Agent

Separate what an agent asks for from what it gets.

An agent asserts detail types. The authority states an envelope. A person permits one task. Three sets, tested in order.

  • Treat what an agent asserts as a request, not a fact.
  • State the envelope on the hop above it.
  • Leave the last cut to the person who authorises the task.

Balance Monitor, operated by Quillon Software Deployment evidence

  1. Requested

    What the agent asserts in its own entity configuration.

    • records.read
    • transfer.status
    • transfer.initiate

  2. Registered

    The envelope the authority permits on this hop.

    • records.read
    • transfer.status
    • transfer.initiate refused

    The subset_of row on tarnbrook.external.reader sets this ceiling. The declaration records transfer.initiate as an over claim.

  3. Granted

    What a person permitted for one task, carried in the token.

    • records.read
    • transfer.status

    This tenant declares no grant record for this agent, so the column shows the ceiling a grant starts from. Where a person grants, the platform tests the grant at the token endpoint and the resource tests its own limit again.

A type a ceiling drops carries the word. A type it keeps carries no mark, because keeping it is not an observation anybody made.

The same release under the Tarnbrook authority is registered for a different envelope. The software is identical. The operator is not.

Accreditation

Let an authority you do not run say something about your agent.

An accreditation is a governance act by a scheme, published on the wire as a trust mark with its own status endpoint.

  • Recognise a scheme as an accepted issuer of marks.
  • Let that scheme grant a role your own authority does not grant.
  • Withdraw the accreditation at the scheme, with a recorded intent.

On this estate Deployment evidence

Agent
Records Assistant
Accreditation
aldercross.accredited.agent
Issued by
Aldercross Scheme Authority
Recognised as an issuer by
The Tarnbrook authority, as tarnbrook.recognised.scheme
What the role sets
authorization_details_types value records.read, transfer.status

Whether a consumer reads this mark before it admits an agent is a property of that consumer. This page states what the authority publishes. Withdrawing an accreditation is one of the five scopes below.

Runtime

Tell an identity apart from the copies that run it.

An agent is one governed record. An instance is one running copy. An attester binds that copy's key and vouches for what it can see.

  • Govern one identity however many copies run under it.
  • Let an attester cut the envelope for a copy it can say less about.
  • Stop one copy without touching the identity.

Two copies, two assurances Deployment evidence

Batch Reviewer
Runs on the workload domain. Authenticates with attest_jwt_client_auth. Assurance attested.
Its evidence
A SPIFFE X.509 SVID from the workload trust domain, so the attester withholds nothing.
Analyst Companion
Runs on a workstation. Authenticates with attest_jwt_client_auth. Assurance asserted.
Its evidence
An operator enrolment only, so the attester withholds records.annotate, transfer.status, transfer.initiate and review.submit.

The attester's stated reason for the second row is that it has a key, an enrolled person and a claimed release, and no evidence about the machine or the binary.

Granted ceiling

The platform issues the token, and it is the last word.

A token carries three ceilings tested in order: registered, attested, granted. The answer names the outermost one that decides the request.

  • Keep the decision at the platform you already run.
  • Hold the resolved answer for the lifetime it prints on itself.
  • Resolve again when that answer expires.

The bounds this tenant prints Deployment evidence

Resolved answer held, at most
300 s
Access token lifetime
300 s
Transfer ceiling
1000.00 GBP

Neither lifetime is a propagation time. Each is how long a consumer may go on trusting an answer it has yet to read again.

Withdrawing an accreditation, on this tenant

The design needs the mark status endpoint to follow a withdrawal. On this tenant it keeps answering active, so a consumer here reads two more surfaces before it admits an agent.

The scheme withdraws

An officer at the scheme, in Connect, with a recorded intent

  1. The mark status endpoint

    The design needs it to answer inactive. On this tenant it keeps answering active for the withdrawn mark.

    Answers activeNot observed on this tenant

  2. The issuer's list

    Drops the agent within seconds when its last claim at that authority goes inactive.

    Observed

Your API platform, admitting the Holdings Reader

Asks the status, then requires the agent on the issuer's list and the role's policy on the issuer's statement. Either one missing refuses the agent.

accreditation_withdrawn

Refused Deployment evidence

How far a revocation reaches

Pick a scope. The figure draws what it reaches and what keeps running.

Choose the scope of the withdrawal

Scope

Another chainRecognised byanother authority.An agentone governed identityAn agent, one governed identity: staysinstance 1running copyinstance 1, running copy: staysinstance 2running copyinstance 2, running copy: goneinstance 3running copyinstance 3, running copy: staysA certificatethe credentialA certificate, the credential: out of scopeAn accreditationthe role it grantsAn accreditation, the role it grants: out of scopeA recognised rootthe recognitionA recognised root, the recognition: staysThe same releasevia another hopThe same release, via another hop: staysAnother chainRecognised byanother authority.An agentone governed identityAn agent, one governed identity: staysinstance 1running copyinstance 1, running copy: staysinstance 2running copyinstance 2, running copy: staysinstance 3running copyinstance 3, running copy: staysA certificatethe credentialA certificate, the credential: goneAn accreditationthe role it grantsAn accreditation, the role it grants: out of scopeA recognised rootthe recognitionA recognised root, the recognition: staysThe same releasevia another hopThe same release, via another hop: staysAnother chainRecognised byanother authority.An agentone governed identityAn agent, one governed identity: staysinstance 1running copyinstance 1, running copy: staysinstance 2running copyinstance 2, running copy: staysinstance 3running copyinstance 3, running copy: staysA certificatethe credentialA certificate, the credential: out of scopeAn accreditationthe role it grantsAn accreditation, the role it grants: goneA recognised rootthe recognitionA recognised root, the recognition: staysThe same releasevia another hopThe same release, via another hop: staysAnother chainRecognised byanother authority.An agentone governed identityAn agent, one governed identity: goneinstance 1running copyinstance 1, running copy: goneinstance 2running copyinstance 2, running copy: goneinstance 3running copyinstance 3, running copy: goneA certificatethe credentialA certificate, the credential: out of scopeAn accreditationthe role it grantsAn accreditation, the role it grants: out of scopeA recognised rootthe recognitionA recognised root, the recognition: staysThe same releasevia another hopThe same release, via another hop: staysAnother chainRecognised byanother authority.An agentone governed identityAn agent, one governed identity: goneinstance 1running copyinstance 1, running copy: goneinstance 2running copyinstance 2, running copy: goneinstance 3running copyinstance 3, running copy: goneA certificatethe credentialA certificate, the credential: out of scopeAn accreditationthe role it grantsAn accreditation, the role it grants: out of scopeA recognised rootthe recognitionA recognised root, the recognition: goneThe same releasevia another hopThe same release, via another hop: stays
  • Stayskeeps authority
  • Goneloses authority
  • Out of scopea separate object with its own control

This figure draws the mechanism rather than this estate, so no chip on it names a runtime component and none carries a treatment. A dashed chip is a running copy or a published artefact.

Stays

  • staysAn agent
  • staysinstance 1
  • staysinstance 3
  • out of scopeA certificate
  • out of scopeAn accreditation
  • staysA recognised root
  • staysThe same release

Gone

  • goneinstance 2

Stays

  • staysAn agent
  • staysinstance 1
  • staysinstance 2
  • staysinstance 3
  • out of scopeAn accreditation
  • staysA recognised root
  • staysThe same release

Gone

  • goneA certificate

Stays

  • staysAn agent
  • staysinstance 1
  • staysinstance 2
  • staysinstance 3
  • out of scopeA certificate
  • staysA recognised root
  • staysThe same release

Gone

  • goneAn accreditation

Stays

  • out of scopeA certificate
  • out of scopeAn accreditation
  • staysA recognised root
  • staysThe same release

Gone

  • goneAn agent
  • goneinstance 1
  • goneinstance 2
  • goneinstance 3

Stays

  • out of scopeA certificate
  • out of scopeAn accreditation
  • staysThe same release

Gone

  • goneAn agent
  • goneinstance 1
  • goneinstance 2
  • goneinstance 3
  • goneA recognised root

stopOne running copy.

Stop one instance?

Only this compromised runtime loses authority. Every other approved instance of the same agent keeps operating.

The attester sets that instance's bit on the signed list it publishes. A platform that reads the list on each token request sees the change at its next read.

A stop is reversible. The identity, the accreditation and the certificate stay exactly as they were.

Reaches
One running copy.
Bound
The platform's list refresh interval, printed by the platform.

Deployment evidence

Deploy, admit, stop and withdraw need an operator credential. This site holds none, so the control is disabled and the figure models the act.

revokeOne credential.

Revoke one certificate?

The agent keeps its governed identity and its authority. It loses one credential, rotates to a new key, and carries on.

Connect's certificate service publishes the new key set, the revocation list and the status responder. Whoever validates that credential reads the list at its next update, printed on the list.

Revoke invalidates a credential, and it is the one act of the five that does. A certificate and the identity it authenticates are separate objects with separate controls, so withdrawing that identity leaves this certificate valid.

Reaches
One credential, and whoever validates it.
Bound
The key set at the next resolve, and the revocation list's next update, printed on it.

Deployment evidence

Deploy, admit, stop and withdraw need an operator credential. This site holds none, so the control is disabled and the figure models the act.

withdrawOne accredited role.

Withdraw one accreditation?

The agent keeps its identity and goes on resolving. It loses one role, so a consumer that requires that role turns it away and every other consumer carries on.

The authority withdraws the accreditation. Its list drops the agent when that was the agent's last claim there. On this tenant the mark status endpoint keeps answering active, so a consumer here also requires the agent on the issuer's list and the role's policy on the statement. On this estate the Larkspur gateway requires the Aldercross mark to admit an agent. The records resource asks for no mark of its own and accepts only a token the API platform issued, so the platform's own admission requirement still stands in front of it.

Withdraw changes what the authority publishes. The identity, the running copies and the certificate stay as they were.

Reaches
The role, at every consumer that requires it.
Bound
The statement lifetime, and the list follows within the mint cadence.

Not observed on this tenant

Deploy, admit, stop and withdraw need an operator credential. This site holds none, so the control is disabled and the figure models the act.

withdrawOne identity, and every copy of it.

Withdraw one identity?

Every running copy of this agent loses authority at once. The same release under another operator keeps operating, because it chains through that operator's own authority.

The authority sets the lifecycle state, then soft deletes the record, which is permanent. Every consumer sees it at its next resolve, bounded by the subordinate statement lifetime printed on the statement.

The accreditation and the certificate are separate records with separate controls. This act reaches the identity and the copies that ran under it.

Reaches
The identity, and every instance of it.
Bound
The subordinate statement lifetime, printed on the statement.

Observed

Deploy, admit, stop and withdraw need an operator credential. This site holds none, so the control is disabled and the figure models the act.

withdrawEvery identity that chains through this hop.

Withdraw the recognition?

Every agent that reached the anchor through this publisher loses authority. Tarnbrook's own copy of the same release keeps operating, because its chain runs through the Tarnbrook authority.

The authority stops publishing the subordinate statement about the recognised root. Every consumer whose chain used that hop stops resolving at its next read.

This is the widest of the five and the last one to reach for. Three of the four controls above would have held the same incident inside a smaller boundary.

Reaches
The recognition, and every identity and instance beneath it.
Bound
The statement lifetime, printed on the statement.

Deployment evidence

Deploy, admit, stop and withdraw need an operator credential. This site holds none, so the control is disabled and the figure models the act.

Why the smallest control is the right one

Act at the layer where the trust changed. A compromised key, a withdrawn accreditation, one bad running copy, a withdrawn identity and a token in flight each have their own control. The smaller control reaches less, and reaching less is the point.

The verb says what the act does to the record. Stop sets a running copy's status bit and a later stop sets it back. Withdraw changes lifecycle or claim state, so the authority stops publishing an identity, an accreditation or a recognition. Revoke invalidates a credential. Three verbs, five scopes, and a reader who knows which verb is on the control knows what survives it.

The control surfaces

Each row names one thing that can change, the surface that carries the change, and the bound a consumer can rely on. The bound is read from the artefact it appears on: the lifetime printed on a statement, the expiry printed on a token, the next update printed on a revocation list.

What changedControl surfaceWho publishesWho consumesPull or pushFreshness boundWhere the capability livesDemonstrated here
One running copyThe instance's status bit on the signed list the attester publishesThe attesterA platform that reads the list on each token requestPullThe platform's list refresh interval, printed by the platformReference implementation (the attester) Deployment evidence
The identity, hosted by ConnectLifecycle state, then a soft delete, which is permanentThe authorityEvery consumer, at its next resolvePullThe subordinate statement lifetime, printed on the statementRaidiam ConnectObserved
The identity, hosted by the enterpriseLifecycle state and claims set inactive, then the catalogue stops publishing the configuration. Reversible.The authority and the catalogueEvery consumer, at its next resolvePullThe statement lifetime, and the catalogue's lifecycle cacheRaidiam Connect and customer side Deployment evidence
A publisher's recognitionThe subordinate statement about the recognised rootThe authorityEvery consumer whose chain used that hopPullThe statement lifetimeRaidiam Connect Deployment evidence
An accreditationThe issuing authority's list, and the role's policy on the subordinate statementThe issuing authorityA consumer that reads the list at admissionPullThe statement lifetime; the list follows within the mint cadenceRaidiam ConnectNot observed on this tenant
A certificateThe published key set, the revocation list, and the status responderConnect's certificate serviceWhoever validates that credentialPullThe key set at the next resolve; the revocation list's next update, printed on itRaidiam Connect Deployment evidence
A token already issuedExpiry, and introspection where the platform offers itThe issuing platformThe resourcePullThe token lifetime, printed on the tokenReference implementation Deployment evidence
A record, for a subscriberThe record change webhookRaidiam ConnectA subscribed systemPushNotification shortens the wait before the next read. The signed source stays authoritative.Raidiam Connect Deployment evidence
The anchor keyEvery consumer's pinned configurationThe consumer's operatorThe consumerConfiguration changeThe overlap window the anchor publishesRaidiam Connect publishes and the customer pins Deployment evidence

Scroll to see all columns.

Two rows deserve a second reading. The accreditation row is where this tenant and the design differ today, and the row says so with the artefacts that show it. The webhook row is a notification rather than a control: it shortens the wait before a consumer reads the signed source again, and the signed source is what decides.

The bounds this tenant declares

300 s

The longest a consumer holds a resolved answer

A consumer that resolved before a change holds its answer until this expires.

60 s

The mark status cache

An answer can rest on a cached status up to twice this old. When the status endpoint cannot be read, the API platform honours a recent active answer for 300 s. On this tenant the endpoint keeps answering active after a withdrawal, which is Not observed in the matrix.

300 s

The access token lifetime

A token already issued runs to this bound, whatever changed behind it.

about 61 s

The mint cadence on this tenant

One run, on 9 September 2026, recorded in the verification register. It is a measurement of one run rather than a property of the design.

A consumer that resolved just before a change holds a valid answer until that answer expires. A token already issued lives to its own expiry. Neither figure is a propagation time. Each is how long a consumer may go on trusting an answer it has yet to read again, and each is printed on the artefact beside it.

A consumer that prefers a shorter window reads on the call and pays for it in latency. That window is a choice for each control, and the governed record answers the same way whichever choice a consumer makes.

The capability rows this page carries, with their evidence
Publication follows the record's lifecycle state. One write changes the record and the publication follows it; there is no second publish action to perform. An authority's entity configuration is served within seconds of its domain mapping, and an entity leaves the authority's list within seconds of its only claim going inactive. Observed

Govern · Publication driven by governed state. Lives in: Raidiam Connect. The row on the evidence page.

The design requires that a withdrawn accreditation stops being issued as a mark and answers not active from the status endpoint within the mint cadence. On this tenant the generated entity configuration and the authority's list drop the accreditation within a minute, while the mark endpoint keeps issuing the mark and the status endpoint keeps answering active. Until this changes, a consumer treats a mark as valid only while the subject is on the issuing authority's list and the subordinate statement carries the role's policy. Not observed on this tenant

Revoke · Accreditation withdrawal reaching the mark and status endpoints. Lives in: Raidiam Connect. The row on the evidence page.

Raw artefact: the declared reads

Every read below is an unauthenticated GET that the capability matrix declares for this page. The command shown is the whole request, and it carries an accept header only.

https://authority.directory.showcase.raidiam.io/authority/96f37fd5-1f2e-4d8e-adbf-de069b3ba978/.well-known/openid-federation

the scratch authority's entity configuration, served three seconds after the mapping was written Read on the wire 2026-09-09.

Fetch it yourself

$ curl -s "https://authority.directory.showcase.raidiam.io/authority/96f37fd5-1f2e-4d8e-adbf-de069b3ba978/.well-known/openid-federation"

https://federation.directory.showcase.raidiam.io/federation_entity/ec54688a-3e67-414d-84e6-9372e736e4c2/list

the scratch federation entity lists the authority Read on the wire 2026-09-09.

Fetch it yourself

$ curl -s "https://federation.directory.showcase.raidiam.io/federation_entity/ec54688a-3e67-414d-84e6-9372e736e4c2/list"

https://authority.directory.showcase.raidiam.io/authority/5bb31966-3818-4454-808d-3d94f9989af7/trust-mark?sub=https://rp.directory.showcase.raidiam.io/openid_relying_party/9108cb50-119d-47a9-b90b-825377971753&trust_mark_type=https://trustmark.directory.showcase.raidiam.io/trustmark/2a0d5e07-22de-4367-87bb-3025b63754d4/showcase-scratch-2/scratch2.accredited

the mark is issued while the claim is active; a withdrawal makes issuance refuse with a 500 naming the inactive claim, re-read both ways on 10 September Read on the wire 2026-09-09.

Fetch it yourself

$ curl -s "https://authority.directory.showcase.raidiam.io/authority/5bb31966-3818-4454-808d-3d94f9989af7/trust-mark?sub=https://rp.directory.showcase.raidiam.io/openid_relying_party/9108cb50-119d-47a9-b90b-825377971753&trust_mark_type=https://trustmark.directory.showcase.raidiam.io/trustmark/2a0d5e07-22de-4367-87bb-3025b63754d4/showcase-scratch-2/scratch2.accredited"