Glossary

AAL: Authenticator Assurance Level (NIST SP 800-63B). AAL3 requires phishing-resistant, hardware-bound authenticators.

Assurance profile: the per-cluster security choices of your security officer, as data validated by a JSON Schema. See Assurance profiles.

Backstage: open source developer portal; our customer portal and trial form.

CAC/PIV: US government smart cards used for sign-in.

CIBA: Client-Initiated Backchannel Authentication (OpenID). Sends an approval request to a person’s device before an agent acts.

cosign: Sigstore tool that signs and verifies artifacts; signs our task records.

DSSE: Dead Simple Signing Envelope, the signed wrapper around an in-toto statement.

Flux: GitOps tool that keeps a cluster equal to what is in Git.

in-toto statement: a standard record saying which artifacts (by hash) a claim is about, and the claim itself.

Keycloak: open source identity provider; sign-in, passkeys, CAC/PIV, federation, CIBA.

Kratix: platform framework that turns a request (a trial) into the work that fulfils it.

O*NET: the US Department of Labor’s database of occupations and their tasks; our agents are seeded from it (CC BY 4.0).

OpenBao: open source secrets manager (a fork of Vault).

OpenTofu: open source infrastructure-as-code tool; builds clusters. tofu-controller runs it from Flux.

OSCAL: NIST’s machine-readable format for controls and assessments; the source of the trust center.

Rekor: Sigstore transparency log for signatures.

SOC code: Standard Occupational Classification code, for example 15-2041.00 (Statisticians); part of each agent’s identity.

SPIFFE / SPIFFE ID: a standard for workload identity; an ID looks like spiffe://acme.reti-infra.com/onet/15-2041.00.

SPIRE: the SPIFFE reference implementation; attests nodes and workloads and issues their identities.

Talos Linux: minimal, immutable Kubernetes operating system managed only by API.

Tenant / trust domain: one customer; its cluster and its SPIFFE trust domain {tenant}.reti-infra.com.

Tornjak: management UI for SPIRE; your security officer’s view of agent identities.

TPM: Trusted Platform Module; seals disk keys and can prove a node’s identity.