Skip to main content

​
Platform Overview

The platform layer gives your solutions shared infrastructure for identity, authorization, resource management, and a unified UI shell. It includes three core services (Governance, Assets, Utilities), a shared common library, and auto-generated SDKs.
The platform is the foundation that every solution depends on. Solutions never implement their own authentication, authorization, or resource management — they delegate to the platform via SDKs.

​
Authentication Flow

Authentication uses Keycloak with a multi-realm architecture where each organization is a separate realm:
1

User Authentication

The user authenticates via OIDC/PKCE flow against their organization’s Keycloak realm. The browser receives a JWT token.
2

Token Forwarding

All API requests include the JWT in the Authorization header. The X-Project-ID header specifies the active project context.
3

Governance Validation

The Governance service validates the JWT, extracts org_id from the realm, and checks OpenFGA for the requested permission.
4

Permission Result

If authorized, the request proceeds. If not, a 403 response is returned. Assets and Utils delegate all permission checks to Governance via SDK calls.

​
Authorization Model

Authorization uses OpenFGA for Relationship-Based Access Control (ReBAC):
When modifying the OpenFGA schema, always update both the .fga DSL file and regenerate the .json runtime file. The Governance service reads only the JSON file at startup. Adding new permissions is safe; renaming or removing is a breaking change.

​
Next Steps

Organizations

Learn how organizations provide multi-tenant isolation.

Agent Registry

Explore the unified registry for A2A agents, MCP servers, and skills.

Authentication

Deep dive into Keycloak multi-realm authentication.

Authorization

Understand OpenFGA and the ReBAC permission model.

Build a solution

Build a new solution on top of these services — start with the 30-minute quickstart.