CRAFT Platform Overview

The shared platform layer providing governance, asset management, and utilities with built-in identity, authorization, and secrets management.

Platform Overview

The platform layer gives your solutions shared infrastructure for identity, authorization, resource management, and a unified UI shell. It includes three core services (Governance, Assets, Utilities), a shared common library, and auto-generated SDKs.

The platform is the foundation that every solution depends on. Solutions never implement their own authentication, authorization, or resource management — they delegate to the platform via SDKs.

Authentication Flow

Authentication uses Keycloak with a multi-realm architecture where each organization is a separate realm:

1. User Authentication

   The user authenticates via OIDC/PKCE flow against their organization’s Keycloak realm. The browser receives a JWT token.

2. Token Forwarding

   All API requests include the JWT in the Authorization header. The X-Project-ID header specifies the active project context.

3. Governance Validation

   The Governance service validates the JWT, extracts org_id from the realm, and checks OpenFGA for the requested permission.

4. Permission Result

   If authorized, the request proceeds. If not, a 403 response is returned. Assets and Utils delegate all permission checks to Governance via SDK calls.

Authorization Model

Authorization uses OpenFGA for Relationship-Based Access Control (ReBAC):

Concept	Description
Roles	owner, admin, member, developer, operator, viewer
Computed permissions	can_read, can_write, can_delete, can_execute, can_manage_secrets
Inheritance	Projects inherit from organizations; resources inherit from projects
Schema	Defined in openfga-schema.fga (DSL) and openfga-schema.json (runtime)

When modifying the OpenFGA schema, always update both the .fga DSL file and regenerate the .json runtime file. The Governance service reads only the JSON file at startup. Adding new permissions is safe; renaming or removing is a breaking change.

Next Steps

Organizations

Learn how organizations provide multi-tenant isolation.

Agent Registry

Explore the unified registry for A2A agents, MCP servers, and skills.

Authentication

Deep dive into Keycloak multi-realm authentication.

Authorization

Understand OpenFGA and the ReBAC permission model.

Build a solution

Build a new solution on top of these services — start with the 30-minute quickstart.