Skip to main content
Symphony Secure Identity and Access Governance (SSIAG) is the independently installable, cgo-free Go foundation for caller-neutral authorization on a Symphony host. It projects effective host authority, gates protected mutations, and integrates with STAV audit before any change becomes visible.

​
What SSIAG provides

  • Exact caller-neutral authorization tied to target-host ownership, granted permission, requested operation, expected state, and owner-configured safeguards
  • Per-TOPS enrollment and local endpoint trust
  • Protected policy lifecycle and provider-installation lifecycle
  • Binding lifecycle with compare-and-swap between active and previous bindings
  • Safe audit metadata prepared for STAV
  • Native launchd and systemd supervision

​
What is deliberately disabled

Operational credential use, canonical knowledge apply, and secret delivery remain disabled. Ordinary foundational mutation fails closed until its required audit route through STAV is complete.
SSIAG does not decide caller class. Human, AI, agent, service, and workload callers are treated identically; authority comes from the target host and the requested operation, not the actor label.

​
macOS Keychain provider

modules/ssiag-provider-macos-keychain is a Swift metadata adapter with a bounded mutually verified handshake and signed-bundle plus session-readiness observation. It exposes provider metadata to SSIAG without granting operational Keychain access, which is intentionally disabled today.

STAV

Per-TOPS append-only audit ledger that SSIAG mutations rely on.

Accordare producer

Bounded SAV Named Version audit circuit that composes with SSIAG.

qxctl lifecycle

Lifecycle administration that consults SSIAG for authorization.

Caller authority

The doctrine SSIAG implements.
Last modified on September 24, 2026