PAI Identity & Access Management (IAM) Architecture
Unique ID Schema (UID)
Every entity in the PAI ecosystem MUST have a persistent Unique ID for audit logging, RBAC, and authorized task monitoring.
| Prefix | Category | Examples |
|---|---|---|
| SYS- | Systems & Nodes | SYS-001 (NAS), SYS-002 (M710q) |
| AGT- | AI Agents | AGT-001 (PAI Nova Claude), AGT-002 (PAI Nova Gemini), AGT-003 (PAI Nova OpenCode) |
| AST- | Assets & Services | AST-001 (Vaultwarden), AST-002 (Authentik) |
| USR- | Human Users | USR-001 (Duane) |
Role-Based Access Control (RBAC)
Roles are defined in Authentik and mapped to Agent IDs.
- pai-admin (Full access, secret rotation, system-level changes).
- pai-agent-privileged (Access to specific production secrets, write access to memory).
- pai-agent-standard (Read-only access to memory, no secret access).
Secret Retrieval (Credential Guard)
Agents never access raw credential files. They must:
- Present their Agent ID.
- Call
fetch-secret.sh <secret_name>. - The script verifies the Agent’s group membership in Authentik/Vaultwarden before returning the secret to memory.