/console on the same host, verified differently: a session token from the Console application at app.capcells.com, presented by a person, or by the agent working for one, instead of a signed request. The handler behind a route cannot tell which door served it; what differs is who may open each.
Nothing at this door replaces the signing door for machines: a console token is a person’s session, and the eleven operations that exist here alone exist here because they are reserved to people.
Signing in
A Console session belongs to an organization’s account. The door verifies the token before any route runs:
Every unusable presentation is one
401 unauthenticated; a usable session reaching for what its role or binding does not cover is 403, with not_permitted_tenant, not_permitted_role or not_permitted_actor naming which line it crossed.
The binding
An organization acts for the tenancies bound to it at onboarding, and the door asks its one question, may this caller act as the tenant in the path, once, above the mount, before any handler runs. Two reads need a usable session and nothing else, no binding, no tenancy, no role:
A person and their agent read both alike.
Roles
The one role distinction is administrator or not, checked as equality, nothing granular to configure.
The key routes read no query string and answer
400 to any; the mirrored tenant routes behave exactly as at the signing door. key minting itself, the form of a key, the one moment its plaintext appears, revocation being irreversible, is on API keys.
Machine credentials cannot beget machine credentials: the key routes exist at this door and nowhere else, and a tenant API key cannot mint, list or revoke anything.
What the agent may not
The agent configures and never conducts. A session marked as the agent’s may read what its person may read, and on a live tenancy may write exactly six things, pinned as a literal in the door itself:
Everything else that writes on a live tenancy, issuing, servicing, every irreversible act, is refused to the agent:
403 not_permitted_actor, this act is reserved to a person. On a sandbox tenancy the gate is not consulted: a sandbox owes nobody, and every operation is permitted there.
The administrator-only operations are closed to the agent entirely, on live and sandbox alike, a key minted by an agent and a policy signed by one are both credentials nobody gave.