AuthSpokeAuthSpoke Developers

Enterprise AI Control Plane

The AuthSpoke control plane architecture for AI assets, agents, connectors, governance, synchronization, policy, and audit.

AuthSpoke is a control plane for enterprise AI. It sits beside existing IAM and provider systems. IAM authenticates people; AuthSpoke governs the AI systems, MCP servers, provider assets, and connector-driven workflows acting inside the enterprise.

Control-plane flow#

Humans, services, agents, MCP servers, and automation
        |
        |  Bearer token / session
        v
AuthSpoke API surface (/api/v1)
        |
        +-- Enterprise AI: agents, models, tools, identities, sessions
        +-- AI Registry: governed AI assets, metadata, ownership, lifecycle
        +-- AI Governance: policies, evaluations, findings, reviews, tasks
        +-- Connectors: catalog, instances, imports, sync, diagnostics, activity
        +-- Platform/support: capabilities, tenant domain, provider operations
        |
        v
Provider systems, enterprise systems, audit stores, and console views

Headless tenant model#

AuthSpoke APIs do not require a tenant subdomain or tenant id inside the route. A call to:

GET /api/v1/ai-governance/findings

is tenant-scoped by the authenticated token/session. The same backend endpoint can be used from:

  • the AuthSpoke console,
  • an MCP server,
  • an AI agent,
  • a CI job,
  • a server-to-server integration,
  • a future SDK or CLI.

Major subsystems#

Enterprise AI#

The /api/v1/ai/* APIs maintain the core AI control-plane inventory: agents, MCP servers, identities, models, tools, sessions, policies, compliance controls, overview, and activity streams.

AI Registry#

/api/v1/ai-assets/* is the governed asset model. It represents imported or manually registered AI resources with ownership, lifecycle, governance state, metadata schema, relationships, cleanup, and per-asset activity.

AI Governance#

/api/v1/ai-governance/* evaluates AI assets against governance policies. It produces findings, supports review actions, creates exemptions, and tracks remediation tasks. Governance actions emit events into the AI activity stream.

Enterprise Connector Framework#

Connector APIs are split into catalog, instance, and workspace layers:

  • /api/v1/connectors/* - metadata-driven connector catalog and manifests.
  • /api/v1/connector-instances/* - headless connector instance lifecycle.
  • /api/v1/integrations/* - workspace APIs for configuration, diagnostics, import, synchronization, operations, reliability, and activity.

These APIs power provider imports such as Amazon Bedrock agent discovery and can also be used directly by automation.

Design tenets#

  • API-first and headless - every capability is reachable through documented APIs.
  • Tenant-isolated - the server derives tenant context and enforces it on every query and mutation.
  • Metadata-driven - connector manifests and AI asset metadata schemas define the UI and automation contract.
  • Event-driven - meaningful changes create activity/audit events.
  • Governance-native - policy evaluation, review, exemption, and remediation are first-class resources.
  • Provider-aware - support/provider APIs exist, but are separate from tenant APIs and permission-gated.