TC-01 Registration request resulting in an Agent Identity Manifest
Register an agent
Submitting this form runs the catalogue's registration policy. If it passes, the catalogue emits an Agent Identity Manifest and hands it to the Trust Controller, which then runs its own identity policy and reaches its own verdict. You will see both decisions, and the artefact that passed between them.
Three prepared requests, so both outcomes can be shown without typing.
A registration that is accepted, and an identity that is issued Both decisions pass. The catalogue emits an Agent Identity Manifest, and the Trust Controller returns an identity outcome carrying the capability envelope the group publishes for that role. A registration the catalogue refuses The catalogue refuses it and no manifest is produced, so the Trust Controller is never asked. Four of the registration checks fail, on five findings between them, each naming the field and the reason. A registration that is accepted, and an identity that is refused The catalogue accepts it, because whether an agent should exist is its decision to take. The manifest is emitted and handed over. The Trust Controller then refuses the identity, because the group publishes no capability role for what was asked for, and no CBA authority can grant the role that was named. The catalogue entry survives the refusal.Run here, by the catalogue
Registration policy
- The agent has a name, and a catalogue id that is well formed and not already taken.
- An owning legal entity in the group, its division, its business unit and a named accountable owner are all recorded.
- A business purpose long enough to be discoverable is written down.
- The version is a release version rather than a branch name.
- A source repository and a software bill of materials are both referenced.
- A manufacturer is named that will attest the running instances of this agent.
- The environment, the authorisation server and the protected resources named are ones the group runs.
- The entity id is an https URL the federation can resolve the agent by.
Nothing in that list decides whether the agent may hold the capability it is asking for. The catalogue is not entitled to take that decision, which is why the capability field below is free text: it must be possible to ask for something that does not exist, and be refused by the party that does decide.
Run elsewhere, by the Trust Controller
Identity policy
- The requested capability is one the group publishes a capability role for.
- Every federation role requested can actually be granted by a CBA authority.
- The owning legal entity maps to an organisation the Trust Controller holds.
- The manufacturer named is one the bank will accept instance attestation from.
- An agent manufactured outside CBA is recognised through the federation rather than registered.
These run only on a manifest. A registration this catalogue refuses never produces one, so the Trust Controller is never asked at all.