Entities and Actors
Agent Stream defines a clear set of actors, credentials, configuration objects, and fabric entities that govern traffic, administration, and identity across the platform. Surfaces →
Operator
The Operator is the human or external system that configures the gateway through the Admin API or dashboard. The Operator is not the caller making proxied runtime requests.
How a Caller is attributed to a Member and a Team
The Caller is the external party making an inbound request to an Access Point. After source authentication and identity resolution, the request may be attributed to a Member and Team for authorization, quotas, metrics, and usage reporting.
How a User’s role controls what they can do
A User is an administrator who signs in to the dashboard or Admin API to operate the appliance. Users have RBAC roles such as user, poweruser, or administrator; each protected action declares the minimum role required.
Secret
A Secret is a provider API key or other sensitive credential stored in the encrypted secrets store and referenced by ID from a Surface, Target, or Pipe. The credential value is not embedded in application code or ordinary routing configuration.
API key
An API Key is a credential used for source authentication or managed identity. It is associated with an agent and external client, stores only a hash of the secret, supports optional expiration, revocation, usage tracking, and one-time secret display: shown once immediately after creating or rotating a key, then never again. Rotating a key creates its replacement and revokes the one it replaces in the same action.

Certificate
A Certificate is a stored TLS certificate typed by purpose: server leaf, client leaf, or CA. It may carry tags, an expiration time, and an optional pre-bound identity DID for mTLS and identity-related flows.

Integration
An Integration is an outbound connector that sends appliance events or alerts to destinations such as email, Slack, webhooks, Kafka, Kinesis, Pulsar, Redis Streams, or Langfuse.
Self Gateway
The Self Gateway is the Gateway record representing the local gateway instance. It carries the local gateway DID and gateway-level policy applied to traffic entering or leaving that gateway.
How a Remote Gateway is resolved and routed to
A Remote Gateway is a Gateway record representing a peer gateway in the fabric. A fabric:// endpoint uses the remote gateway identifier to resolve and route traffic to that peer.

Department
A Department is an organisational ownership reference for Surfaces. A Surface can be tagged with an owning department for organisational scoping, and that department reference is passed into relevant identity and credential flows. Department identity and DID-document data are resolved through the associated trust or identity system.
Related
- Architecture: Overview of data plane and control plane architecture.
- Security and access control: Source authentication, identity hashing, and credential binding.
- Cost and attribution: How a Caller’s attribution to a Member and Team feeds quota and spend governance.
- Trust Fabric integration: Appliance-to-appliance DIDComm connectivity and gateway records.
Glad to hear it! Please tell us how we can improve more.
Sorry to hear that. Please tell us how we can improve.
Thank you for sharing your feedback so we can improve your experience.