Skip to main content

Identity & Access

Most platforms bolt a machine-identity system beside their user directory and a separate agent registry beside that. System9 has one directory. People, machines, and AI are all first-class principals in the same foundation, created through the same pipeline, carrying the same kind of cryptographic identity, and authorized along the same delegation path.

The consequence is the property that makes every other security claim spendable: every action anywhere in the estate traces back through an unbroken cryptographic chain to the human or organization that authorized it. There is no point in the chain where the answer becomes "a service account someone made years ago."

In this area​

  • The entity model: the crypto-bearing principal kinds, and how groups, roles, and policies relate to them.
  • Authentication: how principals prove who they are, the crypto material each holds, and how the customer's existing identity provider federates in.
  • Identity federation and SSO: connecting Entra ID, Okta, Google, Ping or any OIDC and SAML 2.0 provider, the enable gate, claim and group mapping, SCIM, assurance floors, and why lockout is structurally impossible.
  • Authorization and delegation, attenuable grants that can only narrow, and the delegation chain that reaches from a person to a field device.
  • Sessions across a node's cells: why a session is node state rather than cell state, what converges how far, and how a peer cell verifies a token without ever holding a shared secret.
  • The entity lifecycle: creation, suspension, archival and purge, and what each one does to the authority an entity holds.

The threads that run through identity​

  • One foundation for every principal. A single identity manager creates users, service accounts, agents, nodes, devices, and organizations through one persona-creation pipeline, no kind-prefixed branching, no separate registries.
  • Everything crypto-bearing. Each principal holds identity material in three formats (X.509, SSH, and OpenPGP) issued by an orchestrator over per-format algorithm managers.
  • Human accountability for machines and AI. An agent requires a valid delegation linking it to a responsible user; a device holds a delegation bound to a parent entity. Authority can be revoked in one call.
  • Authority only ever shrinks. Every delegation narrows the authority above it, scope, tools, clearance, compartments, and lifetime can only tighten, never widen.

Core and edge​

The identity contract holds on both runtimes. Certificate-bound identity, mutual TLS, attenuable delegation with certificate-fingerprint binding, and offline grant-chain verification are shared concepts, pinned across the two implementations. Some surfaces are runtime-specific and are named as such: human authentication (password, MFA, WebAuthn) and enterprise identity federation are cell-side; on-device key generation, hardware-fingerprint enrollment, and device profiles are edge-side. See Core and Edge.

  • Roles and permissions, the catalog itself: every permission, all 48 built-in roles and what each is for, and the scope a grant attaches at.
  • Governance (Deny-Closed), grants and capability control are the enforcement side of the authority identity establishes.
  • Signing & Cryptography, the certificate systems and key custody behind every identity.
  • Classification, clearance and compartments travel on the identity and its delegations.