One organization for the people and the agents that work in it.
garam holds the identities, the structure they belong to, and the policy documents that decide what each may do. The people are here today; an agent already has an identity, is a subject of the same policies, and exchanges messages on a listener of its own — the adapter that would run beside it is not built.
Sign in with the Google account your organization invited.
- user
- alice
- group
- eng
- agent
- bot-1
A policy attaches to an identity: a user, a group, or an agent.
What an organization holds
The structure people are invited into, and the policy documents that decide what anything in it may reach.
Invitation, not signup
An organization grows by invitation, never by open signup. A single-use, expiring token admits a user with a fixed org role — admin or member, never owner.
Groups and projects
Groups bundle people; a project holds a unit of work. Both live under one organization, carry their own members, and can hold roles scoped to that resource alone.
Policies attached to identities
IAM-style documents, stored per organization and versioned append-only. Attaching one to a user, a group, or an agent decides who it reaches, and a matching Deny anywhere in the set ends the decision.
One identifier system
Organizations, groups, projects, policies, users, and agents all carry a GRN, so one shape answers who a subject is and what a policy is written about.
Reachable, not yet watched
The listener, the certificate authority behind it, and the message queue are built. What is not is the adapter that would run beside the agent, or any way to watch one work.
- ADR-0012
Identity and assignment
garam mints an agent's GRN inside an organization and a project and never changes it, so which operator runs the agent is a relation a reassignment moves rather than part of the identity. That operator provisions it from inside a cluster garam never dials into.
- ADR-0013
Messages
A message reaches an agent when an adapter beside it long-polls a queue held in Postgres, so any garam instance can answer any poll. Channels such as Slack are consumers of that API rather than part of it.
- ADR-0014
Authentication
An agent presents a client certificate whose SAN URI is its GRN, on a listener that takes no session cookie. It holds no user row and no org membership; that GRN is what lets it message every recipient in its own organization, a policy attached to it narrows that with a Deny, and no policy widens it past the organization (ADR-0024).
One name shape, five segments
A GRN names every resource in the system. Its organization and project segments name the resources that own it, so an agent is addressed inside an organization the way a group or a project is.
- grnprefix
- acmeorganization
- defaultproject
- agentservice type
- bot-1identifier
default is the project segment of an org-level resource. API paths address organizations, groups, projects, and policies by the last segment.
In the console today
The organizations you belong to, and for each one its groups, projects, and members with their roles.
Open the console