Identity Fabric

Officials and citizens on one identity plane.

Inside Identity Fabric

A single identity fabric for the whole state: role-, agency-, and branch-scoped RBAC for every government function; mandatory 2FA for officials; PKI for official signatures; citizen accounts with national-ID integration adapters; delegation and acting-capacity handling for the realities of government staffing.

ASTRAEA product interfaceProduct demonstration
ASTRAEA ASTRAEA Commons workspace with illustrative records
Product demonstration with illustrative records. The Republic of Meridia is fictional. Select the image to view it full size.

Identity Fabric in the demo

Illustrative records rendered from the fictional Republic of Meridia demonstration.

Audit spine · ASTRAEA demo
SeqActionHash
#1incident.recorded9d9e71bde5…
#2referral.received3a4d2939d9…
#3case.raffledcd05d996a2…
#4case.decided516b15c866…
#5custody.intake1d8659a519…
Every act appends a hash-chained event; one click verifies genesis to head. Rendered from the demo's seeded world — fictional data.
Exchange traffic · ASTRAEA demo
TypeRouteStatus
ArrestReferralPort Meridia PD → City Prosecutoracknowledged
ChargeFiledCity Prosecutor → RTC Port Meridiaacknowledged
CaseRaffledRTC Port Meridia → All partiesacknowledged
WarrantIssuedRTC Branch 12 → Port Meridia PDacknowledged
WarrantServedPort Meridia PD → RTC Branch 12acknowledged
Typed, receipted, idempotent interagency messages — the folder that vanished between agencies becomes a receipt trail. Rendered from the demo's seeded world — fictional data.
Public verification · ASTRAEA demo
VER-CLR0871MQClearance CLR-2026-0871 authentic — no record
Any state-issued artifact — receipt, permit, clearance, gazette page — verifies at /verify against its ingest hash. Rendered from the demo's seeded world — fictional data.

Everything this module does

The full capability set — nothing hidden behind a toggle.

Branch-scoped RBAC
Permissions are scoped by role, agency, and branch — a clerk of court, a permit officer, and a committee clerk hold disjoint capability sets on the same platform. Every screen, query, and export honors the same policy engine.
Mandatory 2FA for officials
No official acts on the record without a second factor. Enrollment is part of onboarding; recovery is an audited, supervisor-approved workflow.
PKI official signatures
Judges, mayors, secretaries, and heads of state sign with certificates issued under the deployment's own authority. Signatures bind identity, capacity, and document hash.
Citizen accounts
One citizen account for all of government, with adapters for national-ID verification where a national identity scheme exists — and enrollment paths where it does not.
Delegation & acting capacity
Officers-in-charge, acting judges, and deputized signatories are first-class: authority windows with start/end dates, visible on every act performed under delegation.
Session & device policy
Configurable session lengths, device registration for high-privilege roles, and immediate revocation on separation — tied to the Civil Service registry where deployed.

How it connects to other offices

Typed, receipted, audited messages move between suites — no folders lost between agencies.

  1. Identity FabricAll suites
    AuthZ decisions on every request
  2. Civil Service & HRIdentity Fabric
    Appointment/separation events drive access

What it produces

The records, certificates, and reports this module puts on the audit spine.

Role & capability matrixDelegation instrumentsCertificate issuance recordsAccess-review reports

Put Identity Fabric to work.

Tell us what you run today — we'll map it in the first call.