Every AI agent gets a verifiable identity and operates under enforced security controls.
One database with three schemas: SHIFT IDP, OpenFGA, and management. Every service owns its own schema, and all management data is stored relationally.
SHIFT Identity Provider for the platform. It issues the tokens and handles login, CIBA, and DPoP on the pre-configured aitrust realm.
Primary audit data store with five indices. It unifies the event data received from SDK clients and from SHIFT Kafka events.
Fine-grained permission engine. It answers a single question: can user X access document Y through agent Z?
Control plane for agent identity. Requests flow from the Agent SDK through Istio to the Management API, which writes to PostgreSQL, OpenFGA, and the AST CA. It exposes ten API groups; a token exchange touches all three backends.
Unified audit ingestion service. SDK events arrive through the REST API, SHIFT platform events arrive through Kafka, and every record is stored in Elasticsearch.
Service mesh routing based on VirtualService rules. It enforces mTLS between the services, manages traffic, and routes each request by path to the platform services.
In-memory cache with two databases. DB 2 serves the Management API config cache and DPoP nonce rotation; DB 3 serves the Audit anomaly detection counters.
A complete, deployable platform with no per-customer code changes.
helm upgrade --install aitrust server/helm/aitrust//api/v1/*, /v1/*, /realms/*)