direction: right

people: "Platform users" {
  prospect: "invited customer"
  owner: "owner"
  admin: "admin"
  member: "member"
  observer: "observer"
  operator: "platform operator\nseparate appliance role"
}

landing: "Public landing · ermahgerd.localhost" {
  page: "branding + sign-in link"
  bff: "public process\nsign-in destination only"
}

console: "Tenant console · console.ermahgerd.localhost" {
  browser: "organization resources only"
  bff: "host-only HttpOnly session cookie\nexact-origin mutation checks"
}

admin_console: "Administrator portal · admin.ermahgerd.localhost" {
  browser: "overview · organizations · customers · invitations\nfleet · events + logs"
  bff: "separate process + cookie\nno tenant resource routes"
}

identity: "Adjacent identity service" {
  login: "local password → short-lived session\nOIDC adapter deferred"
  admin_login: "private admin listener\nsame accounts · admin-audience sessions"
  policy: "central RBAC decision"
  repo: "identity SQLite" {
    orgs: "organizations + stable namespaces"
    memberships: "users + organization memberships\nseparate platform roles"
    credentials: "hashed organization tokens + S3 access keys\nread-only / read-write + resource scopes"
    audit: "authorization audit records"
    onboarding: "hashed one-time invitations\ncustomers + organization-creation grants"
  }
}

access: "Application Access service" {
  applications: "protected Worker hostnames"
  groups: "reusable role + email groups"
  policies: "ordered allow / block policy"
  sessions: "one-time callback + host-only app cookie"
  service_tokens: "application-scoped automation credentials"
}

deploy: "Deployment path" {
  wrangler: "Wrangler\naccount UUID + bearer token"
  control: "control plane"
  routes: "HAProxy exact-host routes"
}

runtime: "Runtime capabilities" {
  public: "anonymous public request"
  caller: "caller Worker isolate"
  binding: "declared service binding"
  target: "target Worker isolate"
  bucket: "organization bucket"
}

people.prospect -> landing.page: "visit public root"
landing.page -> landing.bff
people -> console.browser
people.operator -> admin_console.browser: "platform health + tenant inventory"
admin_console.browser -> admin_console.bff
admin_console.bff -> identity.admin_login: "admin session + platform role"
admin_console.bff -> identity.repo.onboarding: "issue / revoke customer invitations"
identity.admin_login -> identity.policy
console.browser -> console.bff
console.bff -> identity.login: "tenant-audience session"
console.bff -> identity.repo.onboarding: "locked-email customer acceptance\nor team invitation acceptance"
identity.login -> identity.policy
identity.policy -> identity.repo.memberships
identity.policy -> identity.repo.credentials
identity.policy -> identity.repo.audit
identity.login -> identity.repo.orgs
deploy.wrangler -> deploy.control: "deploy <worker> to organization"
deploy.control -> identity.policy: "workers.read / workers.write"
deploy.control -> deploy.routes: "<worker>.<namespace>.workers.ermahgerd.localhost"
console.bff -> identity.policy: "members · roles · tokens · audit"
console.bff -> deploy.control: "Worker inventory · versions · deployments"
console.bff -> access: "Access configuration + events"
access -> identity.policy: "login + organization membership"
runtime.public -> deploy.routes: "tenant hostname"
deploy.routes -> runtime.target: "unprotected hostname"
deploy.routes -> access.applications: "protected hostname"
access.policies -> access.groups
access.sessions -> runtime.target: "verified browser assertion"
access.service_tokens -> runtime.target: "verified application scope"
runtime.caller -> runtime.binding: "env.TARGET.fetch(request)"
runtime.binding -> runtime.target: "same organization only\ntrusted caller headers"
runtime.caller -> runtime.bucket: "declared R2 binding\nsame organization only"

note: "Customer invitations grant account-level organization creation. Team invitations grant one organization role only.\nOrganization tokens, Access service tokens, and S3 keys belong to one organization and secrets are shown once.\nHAProxy removes trusted caller and Access assertion headers from public traffic. Service and R2 bindings grant named capabilities only."