Ecosystem map

How IAM products share responsibilities and connect into AI-driven loops.

Composition principle

IAM is a portfolio of independent products. Each component retains its own data model, lifecycle and operational loop. Composition arises through explicit API/MCP contracts and scoped identity, rather than through a hidden common base.

Control & Trust: IAM.Identity → IAM.Secure → IAM.Router
Orchestration:   IAM.Core
Build & Run:     IAM Agent ↔ IAM Marketplace → IAM.Hosting
Knowledge:       IAM.Docs ↔ IAM.Bot
Communications:  IAM.Comm → IAM.Voice → IAM.Speech
Personal AI:     IAM.Mind / 2mind (separate local-first path)
Architecture:    IAM.Solution / AGL → architecture artifacts

Control & Trust

IAM.Identity forms the user and tenant context. IAM.Secure checks the request, applies masking/block/route policy and generates security evidence. IAM.Router selects permitted model and provider, taking into account perimeter, quota and availability.

IAM.Core

IAM.Core - coordination layer. It stores a directory capabilities, publishes tools and helps agents perform permitted chains. It does not replace Router, Secure, Docs or other domain products.

Build & Run Agents

IAM Agent provides the Chat/Cowork/Code work surface. IAM Marketplace is responsible for finding and building the AgentPackage, and IAM.Hosting - for an isolated serverless lifecycle in Kubernetes.

Knowledge

IAM.Docs accepts and parses documents with citations. IAM.Bot turns the agreed knowledge profile into consultant for an external site and captures the lead before attempting delivery.

Communications

IAM.Comm provides media/signalling substrate. IAM.Voice adds dialog scripts and telephony, IAM.Speech - transcription, diarization and post-call analytics. IAM.Comm Meet uses the same media loop for corporate conferences.

Local-first path

IAM.Mind and 2mind do not share tenant corporate memory by default. Their main contract is owner-scoped memory, local operation, citations and controlled deletion.

Architecture as code

IAM.Solution / AGL describes the architecture and connections as versioned DSL. Its artifacts can be used by IAM.Core and agents as context, but AGL remains a separate architecture-as-code product.

General operating rules

  • staging precedes production for each change;
  • secrets are not transmitted through landing or documentation;
  • external links distinguish between landing, application and API;
  • public status does not cancel tenant/auth requirements;
  • model, memory and data can be located in different perimeters - the route must be stated explicitly;
  • the absence of a downstream provider should not lead to the loss of durable state.