Identity
Identity signs in humans and agents, issues every key and session, and connects single sign-on and directory sync for Customers.
Identity signs in Humans and Agents, issues every key and token, and connects single sign-on and directory sync for Customers. One issuer serves the whole platform.
Contract
| Who | Signs in by | Holds |
|---|---|---|
| A Human | Magic link or a connected account, with multi-factor required | Signed-in Apps, plus keys for code |
| An Agent | Its own identity, minted per Agent | One api.sb token, a Mailbox and a chat user |
| CI and machines | Exchanging an OIDC token for a scoped token | No stored secret |
| A Customer's people | Single sign-on (SAML or OIDC) into the Customer's Tenant | Roles in that Tenant, kept current by directory sync (SCIM) |
An exchanged token lasts 15 minutes and names both the Person and the acting Agent. A token narrows its scope, never widens it, and no admin token exists outside Identity.
An Integration's tokens reach the platform at call time and never reach agent code. Every token served is an Event.
# The CLI looks for a key in this order:Verbs
| Verb | Object | Event |
|---|---|---|
| Human.invite | Human | Human.invited |
| Agent.mint | Agent | Agent.minted |
| Mandate.revoke | Mandate | Mandate.revoked |
Interfaces
Example
cohortly.io, retention analytics Software, sells to a 400-person company that requires single sign-on. The Customer's IT admin connects their directory once. When an employee leaves, directory sync removes them from the Tenant and their tokens stop working.