Control & Trust·production

IAM.Core

Coordination layer for tools, agents, APIs and MCP contracts.

Landing Application
IAM.Core interface
Current public IAM.Core surface. The screenshot was verified when the documentation was published.

Key capabilities

  • Tool catalog and capability discovery
  • Agent session context and tenant scope
  • Cross-product MCP and API call composition

Role in the ecosystem

IAM.Core connects stand-alone IAM products into a controlled chain. He gives the agent a catalog of available capabilities, a permission context, and a single method call the tool. Core does not perform the domain functions of Router, Secure, Docs or Comm does not turn the portfolio into a monolith.

Main scenario

  1. The agent or application opens a session with the tenant/user context.
  2. Core returns the available MCP/API tools for this scope.
  3. The client selects a capability and forms a structured call.
  4. Policy/identity checks are performed before domain action.
  5. The result and audit context are returned to the initiator.
agent session → tool discovery → scoped invocation → product capability → receipt

Architecture and integrations

Core acts as a control-plane boundary for the tool registry. Typical outline uses IAM.Identity for identity/tenant scope, IAM.Secure for inspection and IAM.Router for a model route. Agent clients connect via MCP or HTTP API.

Only capability metadata and scoped calls are exchanged with Marketplace Core: The user agent runtime remains at IAM.Hosting.

Data and security

  • capability catalog should not contain secrets;
  • credential references remain scoped to the user/tenant;
  • unknown tool or unsuitable role ends in fail-closed;
  • downstream content is considered untrusted until the policy check;
  • correlation/request id goes through the entire chain for auditing.

Operation

Check registry health, availability of critical tools, latency and share failures for each downstream. The new instrument is first registered and checked for staging; only then the capability is published to production agents.

Limit of responsibility

Core coordinates but does not store the shared memory of all products and does not replace them own API. If you use one product without cross-product workflow, direct integration with its API may be sufficient.