Canon

06 — Identity, Configuration, Integration, Discovery and Activation

Canonical reference: 00-SPINEWORKSPACE-INTEGRATEWISE-CANON.md §15
Status: Canonical

1. One Auth-to-Ecosystem

One Auth establishes a common organizational identity and delegation model for humans, Twin, agents, services, AI hosts, automations and API clients. It resolves user/agent identity, tenant, workspace, role, consent, scope, delegation and service-principal context.

One Auth does not replace every provider OAuth credential. Provider credentials remain managed connection artifacts. One Auth provides the shared organizational authority context around them.

2. Configuration Manager

Configuration Manager defines tenant structure, provider choices, policy, composition, memory, AI/model and synchronization choices.

3. Integration Manager

Integration Manager owns connection lifecycle: OAuth, direct connectors, mappings, webhooks, subscriptions, discovery, health and sync policy. It must not write canonical business entities directly.

4. Discovery

Discovery has multiple forms:

  • provider and connector discovery
  • object and schema discovery
  • event discovery
  • capability discovery
  • MCP server/tool discovery
  • agent discovery
  • model/runtime discovery
  • health and availability discovery

Discovery answers what exists. It does not authorize execution.

5. Activation Manager and Activation Bridge

Activation Manager is the administrative/product surface used to control what becomes active.

Activation Bridge is the runtime compiler that converts configuration, identity, role, department, connected data, policy, capability and memory settings into an active tenant/workspace definition.

Configuration
+ Identity
+ Connections
+ Discovered Objects/Capabilities
+ Base Spine
+ Role / Department / Industry
+ Policies / Entitlements
+ Memory / AI / Sync Choices
        ↓
Activation Bridge
        ↓
Compiled Active Runtime Definition