Installed product: OpenTenBase AgentX; supported backends: pg; edition: Community; license: Apache-2.0. Other backends and Enterprise-only capabilities discussed below describe differences; they do not extend this package's scope.
OpenTenBase AgentX provides PostgreSQL Community capabilities. Database records determine identity, authorization, capability state, attempts, leases and audit. Model text, Skills, graph edges, URLs, framework callbacks, client-supplied Agent IDs and visible buttons do not grant authority.
Human users, platform Agents, external Agents and the Schema Owner are distinct. Inactive, revoked, expired, unknown or credential-mismatched identities fail closed. Ordinary Business Agents use independent PostgreSQL LOGIN roles and cannot fall back to Owner credentials. Configuration and encryption keys remain readable only by the operating account.
Trusted identity mappings and forced RLS bind an Agent to its native role. Client-set session text cannot override that mapping. The bounded trusted-Owner policy resolves each table's actual owner; ordinary Agents are not Owner members. Direct partition access must also remain denied. Demonstrate coverage with native negative tests, not a service-side filter. See minimum privileges.
Normal offboarding commits platform revocation before a separate observed
PostgreSQL NOLOGIN/local-connection step. Retain the exact native mapping and
result audit. A disabled Principal or HTTP success alone does not establish
native closure. No additional account-status view is required. New-login denial
does not terminate existing external sessions or remote processes. See
native identity operations.
Fresh initialization requires a deployment-specific administrator password, at least 12 characters under the existing policy. Only the Argon2id hash is stored. There is no supported default password. Noninteractive input uses a current-user-owned regular file with mode 0600 or stricter; plaintext must not appear in arguments, journals, evidence or public configuration.
Human self-registration and external Agent registration are independent policies. Closing the Human registration entrance does not close Agent Enrollment. Enrollment requires an authorized sponsor, scoped grant, credential proof and activation. A one-time compatibility client secret or Ed25519 proof is exchanged for a short-lived instance token. Tokens retain exact scopes, instance fencing and current authority; enrollment alone does not grant model, Embedding, tool or data access.
Dashboard and Portal sessions use separate port-scoped cookies. Authenticated mutations require session-bound CSRF tokens. Status, permission revision and revocation are checked against the database. Browser storage, request body IDs and stale cached permissions are not authentication.
Organizations describe responsibility and Knowledge scope. Security Domains are collaboration authorization boundaries; Channels are conversation surfaces. Current membership is checked for listing, message/history/thread access, Gateway admission and work operations. Membership suspension or revocation blocks later access without erasing retained history.
A Channel member does not automatically gain Knowledge, Memory, tool, model, export or database-row rights. Legacy execution groups need explicit active Domain bindings and current participant checks. A conversion draft lists candidates for review; it is not a membership grant. Cross-domain transfers require an explicit Bridge policy and classification checks.
Knowledge reads apply company-public, organization-subtree, hierarchy-level or Principal-private policy consistently across list, item, graph and retrieval. Portal and Channel retrieval use the Human/Agent authorization intersection. Ambiguous vendor/product queries require appropriate relevance or clarification; an unrelated product document is not a valid answer merely because it matched a keyword.
Provider keys remain encrypted server-side and redacted from reads. The optional model gateway records request metadata, digests, usage provenance, cost and latency, not prompts, generated bodies, authorization headers or hidden reasoning. Direct traffic is unobserved without verified imported evidence. The wallboard exposes bounded authorized read-only projections.
Health and capability evidence binds the exact Provider Profile revision. Refusal, incomplete completion, malformed output, truncated streams and mixed model chunks must not verify capabilities. Closing a client connection does not establish that a remote provider stopped computation.
Embedding Contracts freeze model, dimension, metric, normalization, preprocessing, modality and source mode. Writes/searches use the effective Space/Binding; incompatible contracts do not share similarity calculations. External Agents require an explicit grant and scoped Gateway token; they do not receive provider secrets. Missing grants and explicit denials fail closed.
Uploaded documents, images, retrieved Knowledge and remote protocol output are untrusted data. They cannot authorize tools or rewrite security policy. Managed inputs remain bounded, scoped, revocable and source-digest checked. Content retention in Knowledge is distinct from body-free usage/telemetry accounting.
Task/Step, Graph, Loop and continuity operations validate current ownership, Domain, expected version, source lineage, budget and policy. Attempts use expiring leases and fencing; stale workers cannot commit after replacement. State change and audit commit together where the operation requires atomicity.
A2A and DB4A2A share typed task identities but retain independent transports. A reference or digest does not grant the receiver access. The original sender, receiver, source snapshot and current policy are checked on retry as well as creation. External outcomes that were not observed require reconciliation; blind retries cannot establish exactly-once side effects.
MCP discovery is not execution approval. Only the exact approved read-only tool contract may execute through the governed path. Rediscovery invalidates prior approval until reviewed. Remote endpoints need registered protocol, version, domain, dedicated credentials, bounds and current authorization. Telemetry sends committed metadata without prompt/output bodies.
Fixed framework execution requires a digest-locked dependency set and verified immutable root filesystem. Arbitrary frameworks, effect replay, live Graph migration and global autonomous repair remain closed. See Agent extensions for the supported protocol scope.
Control-plane startup does not prove that a host can safely run untrusted Agents. The runtime target must pass UID/GID, namespaces, cgroup v2, seccomp, read-only-root, capabilities, mounts and egress checks. Agent state cannot override template minimum isolation. Shared workers must not reuse credentials, workspaces, conversation state or database sessions across Agents.
Containment revokes instance tokens and reports each action's outcome. Remote process termination requires an actual infrastructure adapter result; a cooperative acknowledgement alone is not proof of OS termination. Draining work for maintenance is separate from incident containment.
Bootstrap Deployment Agent executes only the local checksum-bound manifest. LLM output never selects SQL, privileges or deployment transitions. Existing data upgrades require an explicit database recovery boundary. Encryption keys, configuration and private journals must be preserved during program replacement. Database replication, backups and standby failover remain operator duties.
AgentX physically omits Enterprise approval, compliance, audit-view and other exclusive modules, while retaining mandatory audit writing and server/database authorization. Do not configure an Enterprise module or Compliance Agent for this product. Platform management conversation is advisory; typed commands still require current permission and risk-policy checks. Model output cannot authorize high-impact decisions.
Use release verification, recovery and runtime isolation for operational checks. Release tests do not constitute an independent security audit or universal isolation, capacity or customer-specific compliance certification.
Every product provides IPv4/IPv6 allowlist or denylist configuration in Platform
configuration. The policy covers all web entry points, returns a generic denial
and preserves direct 127.0.0.1 recovery with normal authentication. See
configuration, proxy trust and recovery.