Entities and Actors

Overview of the actors, entities, credentials, and organizational references managed across Agent Stream.

Agent Stream defines a clear set of actors, credentials, configuration objects, and fabric entities that govern traffic, administration, and identity across the platform. Surfaces →

Operator

The Operator is the human or external system that configures the gateway through the Admin API or dashboard. The Operator is not the caller making proxied runtime requests.

How a Caller is attributed to a Member and a Team

The Caller is the external party making an inbound request to an Access Point. After source authentication and identity resolution, the request may be attributed to a Member and Team for authorization, quotas, metrics, and usage reporting.

How a User’s role controls what they can do

A User is an administrator who signs in to the dashboard or Admin API to operate the appliance. Users have RBAC roles such as user, poweruser, or administrator; each protected action declares the minimum role required.

Secret

A Secret is a provider API key or other sensitive credential stored in the encrypted secrets store and referenced by ID from a Surface, Target, or Pipe. The credential value is not embedded in application code or ordinary routing configuration.

API key

An API Key is a credential used for source authentication or managed identity. It is associated with an agent and external client, stores only a hash of the secret, supports optional expiration, revocation, usage tracking, and one-time secret display: shown once immediately after creating or rotating a key, then never again. Rotating a key creates its replacement and revokes the one it replaces in the same action.

The API Key Created dialog after rotation, showing a new one-time secret and the Rotated From field naming the previous key, with the old key now Revoked in the list behind it

Certificate

A Certificate is a stored TLS certificate typed by purpose: server leaf, client leaf, or CA. It may carry tags, an expiration time, and an optional pre-bound identity DID for mTLS and identity-related flows.

The New Certificate form, with the Kind field set to Server leaf and helper text explaining all three purposes

Integration

An Integration is an outbound connector that sends appliance events or alerts to destinations such as email, Slack, webhooks, Kafka, Kinesis, Pulsar, Redis Streams, or Langfuse.

Self Gateway

The Self Gateway is the Gateway record representing the local gateway instance. It carries the local gateway DID and gateway-level policy applied to traffic entering or leaving that gateway.

How a Remote Gateway is resolved and routed to

A Remote Gateway is a Gateway record representing a peer gateway in the fabric. A fabric:// endpoint uses the remote gateway identifier to resolve and route traffic to that peer.

The Gateways list showing the local gateway record and a remote gateway record, with their name, type, and status

Department

A Department is an organisational ownership reference for Surfaces. A Surface can be tagged with an owning department for organisational scoping, and that department reference is passed into relevant identity and credential flows. Department identity and DID-document data are resolved through the associated trust or identity system.