Approving software and issuing it an identity are two decisions with two owners.

The catalogue stands in for whichever approval system you run: a catalogue, a change workflow or a pipeline. That decision stays where it is. When Imogen Falk approves the Records Assistant, the catalogue calls Raidiam Connect. Connect records the statement and a certificate over a key the catalogue generated, and the role claims wait for accreditation. The accreditor grants them in the accreditation console, and Connect refuses any role the organisation does not hold. When the authority lists the agent, every platform that trusts the Tarnbrook authority can resolve it.

Connect keeps three objects apart. A release is a versioned build with a digest and a signature from its publisher. An agent is a governed identity with its own federation identifier, its own roles and its own lifecycle state. An instance is one running copy, with a key generated in process. The catalogue asks for the second. The third arrives in use case 4.

The organisation then allocates from what it holds, and Connect refuses anything else.

A statement claim that references a claim the organisation lacks is refused by Connect, with an answer that names the referential rule and scopes it to the organisation. The three writes in the figure were made on a scratch statement on this tenant on 9 September 2026, and the statement's claim list stayed at one. Observed

The rows set on a role become the policy operators in the subordinate statement the authority signs about the entity. Where two roles set the same claim, the figure joins their values the way the estate's own derivation does, metadataPolicy in packages/estate/src/derive.ts. The agent's own entity configuration carries its software and its keys, and the authority supplies the rest, so a consumer reads what the authority says. The projection was read on the wire on 9 September 2026 for a scratch agent. The figure draws the Records Assistant as the estate declares it. Observed

Publication follows the record's lifecycle state. An authority's entity configuration is served within seconds of its domain mapping, and an entity leaves the authority's list within seconds of its only claim going inactive. Observed

Two things did not follow in the same reading. The subordinate statement about the withdrawn agent stayed served: its policy was already empty at the 4 second poll, and it was minted again at 61 seconds. Product change T4 asks that it answer 404 instead. The trust mark status endpoint is the Not observed line under the figure, and product change T3 covers it. Use case 6 shows what a change reaches, and when each consumer reads it.

The operator beside each name tells them apart, and the route that lists each one decides what that copy may ask for.

Every value in the figure is declared in packages/estate/src/world.ts. The claim page reads the same declaration and refuses to serve unless every agent here matches it.