Raidiam
Book a working session

How it works

Raidiam publishes the trust. Your infrastructure makes the decision.

An agent calls your platform for the first time. Raidiam Connect publishes its signed chain. Your platform walks the chain to the anchor you pin, folds the policy, checks the mark, and issues a token for what the request names once it fits the ceilings.

Run the trust checkHow your platform checks it

  1. Presents

    The agent calls with its identifier and a signed client assertion

    Agent

    Records Assistant

    Identifier
    rp.directory.showcase.raidiam.io/openid_relying_party/70219aeb…
    Proves it with
    A client assertion signed with its authentication key private_key_jwt
    Asks for
    records.read
    Client record on your platform
    None needed in advance

  2. Resolves

    Your platform walks the signed chain to the anchor it pins

    1. AgentRecords Assistant
    2. lists the agent
    3. AuthorityTarnbrook Financial Group
    4. lists the authority
    5. Trust anchorTarnbrook anchorKey held in your configuration

    The walk follows authority_hints

  3. Folds

    The policy on the chain sets what the agent may ask for

    Policy, folded anchor first

    1. Tarnbrook anchorMembership only on this hop
    2. Tarnbrook Financial Groupvalue sets 4 detail types
    3. Over the agent's own metadataRecords Assistant

    Registered ceiling

    records.read records.annotate transfer.initiate transfer.status

    Mark tarnbrook.agent.memberSigned by its issuer. Its status is asked of the issuer.

  4. Issues

    The request is checked against each ceiling

    Registered by the authority4

    Attested equals registered, because this agent has no attester4

    Outside this request

    records.annotate transfer.initiate transfer.status

    Granted on this grant, the request itself1

    records.read

    Access tokenCarries the types the request namedrecords.readAPI platform, 300 seconds

  • Authority resolved on first contact

    Your platform resolves and checks the agent's authority on its first request, rather than from a record held beforehand.

  • One record for every platform

    Each platform reads the same signed record and derives its own client.

  • Authority you can check

    Your platform checks each required mark's signature and asks its issuer for its status.

  • Withdraw once

    Withdraw the authority once and every consumer reads again when its answer expires.

Read the evidence behind this

Which of your platforms supports automatic registration under OpenID Federation today, and which needs the chain walk in front of it?

Ninety minutes, on the shape of your estate: which systems resolve first, which anchor each pins, and which key each party holds.

Book a working session
See it on one agent Resolved, not registered