Caber Systems Documentation

Appearance

Zero Trust Identity, OBO Provenance, and Credential Architecture ​

In multi hop AI pipelines, autonomous orchestrators, sub agents, and MCP servers routinely authenticate to downstream APIs using shared service credentials. Caber preserves the initiating human principal across every hop using canonical subject identifiers (caber_identity), W3C traceparent and baggage propagation (caber.user and caber.email), fast path directory replication (caber_resolver), and PostgreSQL On Behalf Of (obo_data) provenance chains. Simultaneously, Caber isolates cloud and SaaS storage credentials inside a pure Rust broker (caber_auth and caber_storage).

Originating HopJWT OIDC SPIFFEinbound is True
<line x1="140" y1="87" x2="162" y2="87" stroke="#38bdf8" stroke-width="1.5" marker-end="url(#idArrow)" /> <rect x="162" y="45" width="135" height="85" rx="8" fill="#0f172a" stroke="#38bdf8" stroke-width="1.5" /> <text x="229" y="76" fill="#f8fafc" font-family="Inter, sans-serif" font-size="12" font-weight="600" text-anchor="middle">SubjectId Mint</text> <text x="229" y="96" fill="#94a3b8" font-family="Inter, sans-serif" font-size="10" text-anchor="middle">iss_sub Canonical</text> <text x="229" y="112" fill="#94a3b8" font-family="Inter, sans-serif" font-size="10" text-anchor="middle">Admit Acting Email</text> <line x1="297" y1="87" x2="319" y2="87" stroke="#38bdf8" stroke-width="1.5" marker-end="url(#idArrow)" /> <rect x="319" y="45" width="140" height="85" rx="8" fill="#0f172a" stroke="#818cf8" stroke-width="1.5" /> <text x="389" y="76" fill="#f8fafc" font-family="Inter, sans-serif" font-size="12" font-weight="600" text-anchor="middle">W3C Baggage</text> <text x="389" y="96" fill="#94a3b8" font-family="Inter, sans-serif" font-size="10" text-anchor="middle">caber.user &amp; email</text> <text x="389" y="112" fill="#94a3b8" font-family="Inter, sans-serif" font-size="10" text-anchor="middle">txnTokenConfig Gate</text> <line x1="459" y1="87" x2="481" y2="87" stroke="#38bdf8" stroke-width="1.5" marker-end="url(#idArrow)" /> <rect x="481" y="45" width="135" height="85" rx="8" fill="#0f172a" stroke="#818cf8" stroke-width="1.5" /> <text x="548" y="76" fill="#f8fafc" font-family="Inter, sans-serif" font-size="12" font-weight="600" text-anchor="middle">IdentityReplica</text> <text x="548" y="96" fill="#94a3b8" font-family="Inter, sans-serif" font-size="10" text-anchor="middle">4 Step Resolution</text> <text x="548" y="112" fill="#94a3b8" font-family="Inter, sans-serif" font-size="10" text-anchor="middle">csi_identity_map v2</text> <line x1="616" y1="87" x2="638" y2="87" stroke="#38bdf8" stroke-width="1.5" marker-end="url(#idArrow)" /> <rect x="638" y="45" width="115" height="85" rx="8" fill="#0f172a" stroke="#34d399" stroke-width="1.5" /> <text x="695" y="76" fill="#f8fafc" font-family="Inter, sans-serif" font-size="12" font-weight="600" text-anchor="middle">OBO Schema v2</text> <text x="695" y="96" fill="#94a3b8" font-family="Inter, sans-serif" font-size="10" text-anchor="middle">PostgreSQL obo_data</text> <text x="695" y="112" fill="#94a3b8" font-family="Inter, sans-serif" font-size="10" text-anchor="middle">Trace Scoped Lock</text> <line x1="753" y1="87" x2="775" y2="87" stroke="#38bdf8" stroke-width="1.5" marker-end="url(#idArrow)" /> <rect x="775" y="45" width="95" height="85" rx="8" fill="#0f172a" stroke="#34d399" stroke-width="1.5" /> <text x="822" y="76" fill="#f8fafc" font-family="Inter, sans-serif" font-size="12" font-weight="600" text-anchor="middle">Rego Input</text> <text x="822" y="96" fill="#94a3b8" font-family="Inter, sans-serif" font-size="10" text-anchor="middle">user.groups</text> <text x="822" y="112" fill="#94a3b8" font-family="Inter, sans-serif" font-size="10" text-anchor="middle">Provenance DAG</text>
Figure 1: End to end principal identity minting, W3C baggage propagation, four step IdentityReplica resolution, and OBO Schema v2 provenance tracking.
## 2. Four Step Email Identity Fallback (`caber.email`) and `GLOBAL.txnTokenConfig`

When an application authenticates a user via an OIDC or SAML identity provider whose iss_sub is not yet linked to a SCIM directory record in csi_identity_map, Caber supports a zero trust Email Identity Fallback (caber.email) governed entirely in Rust.

3. WebSocket Identity (ConnectionHandle), Streamlit Session Isolation, and OBO Schema v2 ​

Long lived WebSocket connections and multi user reactive frameworks (such as Streamlit on Tornado) require per connection and per session identity isolation so concurrent browser sessions never bleed identity across threads.

5. Enterprise AI Provenance Checkpoints and Standards Mapping ​

Alignment with External Provenance and Telemetry Standards ​

Caber maps its internal provenance graph and telemetry envelopes directly onto five industry standards:

  • W3C PROV (prov:Entity, prov:Activity, prov:Agent): Maps :Data and :Region nodes to prov:Entity, API and MCP span executions ([:CALLS]) to prov:Activity, and :Principal (iss_sub) plus :Agent identities to prov:Agent (prov:actedOnBehalfOf).
  • C2PA 2.4 Content Credentials: Aligns content addressed VerdictSnapshot v3 manifests and SHA256 span bindings with C2PA hard bindings (cryptographic digests) and soft bindings (WRL sub sentence fingerprints that survive reformatting).
  • SLSA 1.2 & in-toto Attestations: Applies supply chain attestation semantics to governance policy compilation (policy-set.json, data.json, and manifest.json signed and content addressed by policy_digest in GSS).
  • OpenTelemetry GenAI Semantic Conventions (gen_ai.*): Preserves standard gen_ai.system, gen_ai.request.model, gen_ai.usage.*, and gen_ai.tool.call.id span attributes across OpenLit and pycaber.auto interceptors while enriching spans with caber.user, caber.email, and audit.edge_verdict_snapshot_ref.