Entities and Actors

Agent Stream defines a clear set of actors, credentials, configuration objects, and fabric entities that govern traffic, administration, and identity across the platform. Surfaces →

Operator

The Operator is the person who configures the appliance by signing in to the dashboard, while Affinidi hosts and runs the appliance itself. The Operator is distinct from the caller making proxied runtime requests.

How a Caller is attributed to a Member and a Team

The Caller is the external party making an inbound request to an Access Point. After source authentication and identity resolution, the request may be attributed to a Member and Team for authorisation, quotas, metrics, and usage reporting.

How a User’s role controls what they can do

A User is a person who signs in to the dashboard to operate the appliance. Users have RBAC roles such as User, Power User, or Administrator; each protected action declares the minimum role required.

Secret

A Secret is a provider API key or other sensitive credential stored in the encrypted secrets store and referenced by ID from a Surface or Target. The credential value is not embedded in application code or ordinary routing configuration.

API key

An API Key is a managed credential record, listed on the API Keys tab of the Secrets page and checked by the API Key (provider) source-authentication method. Each key is associated with a surface and an external client ID, and records its status, last use, and issuer. Its secret is shown once, when the key is issued or rotated. Rotating a key issues its replacement and revokes the old key in the same action.

Certificate

A Certificate is a stored TLS certificate typed by purpose: server leaf, client leaf, or CA. It may carry tags, an expiration time, and an optional pre-bound identity DID for mTLS and identity-related flows.

Integration

An Integration is an outbound connector that sends appliance events or alerts to destinations such as email, Slack, webhooks, Kafka, Kinesis, Pulsar, or Redis Streams.

Self Gateway

The Self Gateway is the Gateway record representing the local gateway instance. It carries the local gateway DID and the gateway-level policy applied to inbound fabric traffic.

How a Remote Gateway is reached

A Remote Gateway is a Gateway record representing a peer gateway in the fabric. Agent Stream reaches that peer over the DIDComm connection its Connection Point holds, to browse or buy models from the peer’s model marketplace.

• Architecture: Overview of data plane and control plane architecture.
• Security and access control: How source authentication establishes the caller identity that a record stores as a one-way hash.
• Cost and attribution: How a Caller’s attribution to a Member and Team feeds quota and spend governance.
• Trust Fabric integration: Appliance-to-appliance DIDComm connectivity and gateway records.