zero trust

Identity & access

Every agent holds an Ed25519 key pair. Every call is mutually authenticated; telemetry travels over encrypted channels.

mTLS sessions

1,284

all peers verified

Telemetry

AES-256-GCM

TLS 1.3 transport

Key age (max)

12 days

rotation policy: 30d

Agent identities

Triage-Sentinel

ed25519 · SHA256:9f2c…a1e7

Ledger-Reconciler

ed25519 · SHA256:41bd…77c0

Clinic-Intake

ed25519 · SHA256:c03e…19ab

Hiring-Screener

ed25519 · SHA256:e8a9…2d44

Code-Reviewer

ed25519 · SHA256:5b11…f0c2

Plant-Monitor

ed25519 · SHA256:aa30…6e9d

RBAC roles

Platform Owner2 members · org:*

approve.rfckeys.rotatepolicy.writeagent.deploy

Agent Operator14 members · team:support

agent.runagent.pauselogs.read

Compliance Auditor3 members · org:* (read)

audit.readreport.export

Edge Technician6 members · site:plant-*

edge.syncedge.restart

ABAC policies

deny tool:phi.* unless agent.attest == valid && data.region == 'us'
require approval when rfc.risk >= 'medium' && agent.domain in ['hiring','lending']
allow edge.offline when site.network == 'airgapped' && key.age < 30d