Governance / Identity & Keys

Agent identity and keys, kept explicit.

Identity and keys are the trust layer beneath the rest of the control plane. They tell the system who is speaking, which tenant it belongs to, and what can be rotated without breaking rollout.

agent identity
SSH keys
API keys
enrollment
trust bundle
Trust model
Identity first. Everything else hangs off that.

Keep the enrollment story short: what is the client, how is it trusted, and how is that trust rotated.

Enrollment

Bind a machine or workspace to a tenant with explicit trust.

Identity tells you who the client is and which agent instance it belongs to.

Agent identity

A stable agent record with name, tenant, workspace, and host mapping.

SSH / API keys

Keys used to authenticate sync clients and support local operations.

Fingerprint checks

A trust bundle can be rotated without changing the product model.

Enrollment tokens

A short-lived path to bootstrap a new client safely.

Operational clarity

Show what is verified, what is pending, and what can be rotated.

Teams can answer trust questions quickly without opening implementation details.

Ownership

Which user or team owns this agent and the keys attached to it.

Rotation

How to replace a key without breaking the agent's place in the fleet.

Revocation

How to disable a stale trust path before it becomes a problem.

Portability

The same object model works for SaaS, NAS, and self-hosted installs.