# Entities and Actors

> Overview of the actors, entities, credentials, and organizational references managed across Agent Stream.

Agent Stream defines a clear set of actors, credentials, configuration objects, and fabric entities that govern traffic, administration, and identity across the platform. [Surfaces →](/products/affinidi-trust-fabric/agent-stream/concepts/surfaces.md)

## Operator

The Operator is the human or external system that configures the gateway through the Admin API or dashboard. The Operator is not the caller making proxied runtime requests.

## How a Caller is attributed to a Member and a Team

The Caller is the external party making an inbound request to an Access Point. After source authentication and identity resolution, the request may be attributed to a Member and Team for authorization, quotas, metrics, and usage reporting.

## How a User’s role controls what they can do

A User is an administrator who signs in to the dashboard or Admin API to operate the appliance. Users have RBAC roles such as user, poweruser, or administrator; each protected action declares the minimum role required.

## Secret

A Secret is a provider API key or other sensitive credential stored in the encrypted secrets store and referenced by ID from a Surface, Target, or Pipe. The credential value is not embedded in application code or ordinary routing configuration.

## API key

An API Key is a credential used for source authentication or managed identity. It is associated with an agent and external client, stores only a hash of the secret, supports optional expiration, revocation, usage tracking, and one-time secret display: shown once immediately after creating or rotating a key, then never again. Rotating a key creates its replacement and revokes the one it replaces in the same action.

## Certificate

A Certificate is a stored TLS certificate typed by purpose: server leaf, client leaf, or CA. It may carry tags, an expiration time, and an optional pre-bound identity DID for mTLS and identity-related flows.

## Integration

An Integration is an outbound connector that sends appliance events or alerts to destinations such as email, Slack, webhooks, Kafka, Kinesis, Pulsar, Redis Streams, or Langfuse.

## Self Gateway

The Self Gateway is the Gateway record representing the local gateway instance. It carries the local gateway DID and gateway-level policy applied to traffic entering or leaving that gateway.

## How a Remote Gateway is resolved and routed to

A Remote Gateway is a Gateway record representing a peer gateway in the fabric. A fabric:// endpoint uses the remote gateway identifier to resolve and route traffic to that peer.

## Department

A Department is an organisational ownership reference for Surfaces. A Surface can be tagged with an owning department for organisational scoping, and that department reference is passed into relevant identity and credential flows. Department identity and DID-document data are resolved through the associated trust or identity system.

## Related

- [Architecture](/products/affinidi-trust-fabric/agent-stream/concepts/architecture.md): Overview of data plane and control plane architecture.

- [Security and access control](/products/affinidi-trust-fabric/agent-stream/concepts/security-and-access-control.md): Source authentication, identity hashing, and credential binding.

- [Cost and attribution](/products/affinidi-trust-fabric/agent-stream/concepts/teams-and-attribution.md): How a Caller’s attribution to a Member and Team feeds quota and spend governance.

- [Trust Fabric integration](/products/affinidi-trust-fabric/agent-stream/concepts/trust-fabric-integration.md): Appliance-to-appliance DIDComm connectivity and gateway records.