Architecture
Platform boundaries, governed objects, the six-layer reference stack and where each decision is enforced.
A common trust layer — not a universal identity provider.
Compute Passport connects enterprise identity, AI platforms, cloud infrastructure and governance systems without replacing anything that already authenticates users or runs workloads. Human authentication stays where it is. What gets added is the agent and execution context that an identity provider was never designed to hold.
Delegate authentication to the enterprise identity layer. Add agent, model, workload, compute, policy and cryptographic identity context. Return signed obligations, status and evidence references to the systems that can enforce them.
| Boundary | Design position |
|---|---|
| Platform purpose | Portable identity, policy, provenance, cryptographic trust and audit control for AI agents, models, workloads and compute. |
| Identity boundary | Human authentication remains with the enterprise IdP. Compute Passport consumes assertions and adds agent and execution context. |
| Decision boundary | The platform constrains, escalates and records execution. Legal and mission authority stay with accountable people and institutions. |
| Assurance boundary | Passports support governance and auditability. They do not by themselves constitute certification, accreditation or government authorization. |
Authority
Sponsor, mandate, delegation, approval, exception and residual-risk acceptance stay assigned to named institutional roles. Software does not accept risk.
Control
Registry, policy decision, status, revocation and evidence services give every platform the same trust semantics.
Enforcement
Gateways, tool interceptors, model endpoints, workloads and business adapters apply the decision where the action actually happens.
Human authentication stays with the enterprise identity provider. This layer consumes those assertions and adds what an IdP does not hold: which agent is acting, on whose authority, with which model, inside which workload, on which compute.
Institutional intent becomes machine-enforceable obligations. A decision names the actor, action, target, context and conditions, and returns obligations the receiving system can actually apply.
Trust is a status service, not a static certificate. Every passport resolves live to active, suspended, expired, retired or compromised, and revocation is observable to every relying party.
Enforcement has to reach the point of action. A decision that never reaches the API gateway, the model gateway, the tool interceptor or the admission controller has not constrained anything.
Identity, policy, approval, action and outcome are recorded as one chain. An action that cannot be recorded is not a permitted action.
Adapters normalize identity, model, workload, policy and evidence events into one trust graph while every existing system of record stays where it is.
A decision that never reaches the action point has not constrained anything.
| Enforcement point | Control function | Failure posture |
|---|---|---|
| API gateway / broker | Validate passport, credential scope, target, obligations and revocation. | Fail closed for protected or high-impact actions. |
| Agent tool interceptor | Evaluate individual tool calls and route approvals. | Block unknown tools; cache only short-lived low-risk decisions. |
| Kubernetes admission / sidecar | Validate workload identity, image, region and runtime limits. | Reject non-compliant workloads; quarantine drift. |
| Model gateway | Restrict provider, version, prompt handling and data class. | Block unapproved model substitution. |
| Business adapter | Enforce case, payment, procurement or record-level conditions. | Hold and open review on critical exceptions. |
This build decides. It does not yet enforce: gateway, admission controller and tool interceptor adapters are the next stage of work. A decision with no enforcement point attached is advice, not a control.