Use case 05
Across the boundary. With trust.
Partners run their own agents under their own root. You recognise that root once, and your ceiling decides what your authority grants them.
You recognise
- Quillon Software
- Larkspur Partners
Outside your organisation
Their agents ask
Your recognition hops
tarnbrook.
Ceiling, subset_of
records.readtransfer.status
Ceiling, subset_of
records.read
Recognitions withdrawn
Tarnbrook Financial Group
Your authority answers
Quillon Software
Balance Monitor
- Its own rootQuillon's root
- Accredited byNone
-
records.Inside your ceiling:read records.Inside your ceiling:read records.No path to your anchorread -
transfer.Inside your ceiling:status transfer.Outside your ceiling No path to your anchorstatus -
transfer.Outside your ceiling Outside your ceiling No path to your anchorinitiate
Larkspur Partners
Holdings Reader
- Its own rootLarkspur's root
- Accredited byAldercross Scheme Authority
-
records.Inside your ceiling:read records.Inside your ceiling:read records.No path to your anchorread
DerivedWorked out from the estate declaration.Worked out from the estate declaration, with your change applied.Worked out from the estate declaration, with your change applied.
Not observed on this tenant The authority resolves both chains and answers, and that answer is the one drawn here. On this tenant the API platform and the workforce platform cannot act on it for the Holdings Reader. Larkspur's root is bound to the Aldercross scheme, so each platform asks its own authority whether it recognises that scheme, that question returns a server error, and each platform refuses the Holdings Reader before a tool is reached. What this page draws is the authority's resolve, not a platform admission of either agent.
Share what you want. Keep control.
-
Trust across boundaries
Recognise a partner root once, and read every agent that chains to it.
-
Scoped access
Your authority grants only what you allowed.
-
Your policy decides
Their claims are an input. Your ceiling is the decision.
-
Revoke the recognition
One governed record per partner. Revoke it and your authority stops listing their root.
Watch
Across the boundary
Which partner should be your second trust domain, and what ceiling would you set?
Ninety minutes, on the shape of your estate: which systems resolve first, which anchor each pins, and which key each party holds.