Docs

Access: roles, identities and devices

People, applications, AI agents and boxes each authenticate differently, and each has its own place in the records.

Roles

Applications: no long-lived PIN

An application presents its identity, a certificate or a workload identity, and receives a short-lived credential. The PKCS#11 PIN slot carries that credential, so a leaked PIN is useless minutes later.

roost identity create orders-api --partition prod --ttl 15m --via spiffe://acme/orders-api

AI agents

roost agent create ledger-bot --on-behalf-of team:finance --keys data-key-eu --actions unwrap --limit 200/h --approve-above 1000

Every action records that the agent acted, on whose behalf, and who approved when a limit was exceeded. roost agent disable ledger-bot cuts one agent off at once. Unused agents expire.

Trusting a box

Clients trust a box by its identity, not its address, so an IP change does not break anything. The first connection uses an enrollment code from the console; the box checks the client, the client checks the box and its attestation, and the enrollment is recorded.

roost enroll --code 7F3K-92QD    # printed by the console; works once

Only port 443 is used. Mutual TLS is set up by the enrollment; nobody copies certificate files by hand.