Skip to main content
Platform provides the management layer for Mistrive deployments. It handles user authentication, organization hierarchy, project isolation, and access control. All other services integrate with Platform for identity and authorization.

​
System components

Identity & Access Management

User authentication, role-based access control, and authorization using a Zanzibar-style relationship model.

Organizations

Top-level containers that group projects and define membership boundaries.

Projects

Resource containers within organizations. Each project isolates its own artifact repositories and service accounts.

Service accounts

Machine identities for automation and CI/CD pipelines. Scoped to projects with key-based authentication.
Platform exposes both gRPC and REST APIs. The management UI provides a web interface for common administrative tasks.

​
Identity and access management

Platform implements a relationship-based access control system inspired by Google Zanzibar. Permissions are defined through relationships between subjects (users, service accounts) and objects (organizations, projects, repositories).

​
Authentication

Platform supports password-based authentication with secure cookie sessions. Authentication state is managed through HTTP-only cookies with configurable domain and security settings.

​
Authorization model

Access control uses a hierarchical role system where higher roles inherit all permissions from lower roles:
The authorization engine evaluates permission checks by traversing relationship tuples stored in FoundationDB. This model supports:
  • Direct grants: User explicitly assigned a role on a resource
  • Inherited grants: Role inherited from a parent resource (organization → project)
  • Computed grants: Role derived from another role (owner implies editor)

​
Roles

Organization-level roles propagate to all projects within that organization. A user with editor on an organization automatically has editor on all its projects.

​
Service-specific roles

Artifact Store defines additional roles for fine-grained repository access: These roles also follow the inheritance hierarchy and can be granted at organization, project, or repository level.

​
Organizations

Organizations are the top-level containers in the resource hierarchy. Every project belongs to exactly one organization.

​
API operations

​
Member roles

When adding members to an organization, specify one of the following roles:

​
Projects

Projects provide resource isolation within organizations. Artifact repositories, service accounts, and IAM policies are scoped to individual projects.

​
API operations

​
Project roles

​
Service accounts

Service accounts provide machine identities for automation workflows. Each service account belongs to a specific project and authenticates using cryptographic keys.

​
API operations

​
Key management

Service account keys are JSON credentials containing:
  • Service account identifier
  • Private key for signing JWTs
  • Token endpoint URI for credential exchange
Keys should be stored securely and rotated periodically. Deleting a key immediately revokes all sessions authenticated with that key.

​
Authentication flow

  1. Load the JSON key file
  2. Sign a JWT assertion with the private key
  3. Exchange the assertion for an access token at the token endpoint
  4. Include the access token in API requests via the Authorization header

​
User administration

Global administrators manage users through the User Admin Service.

​
API operations

​
User lifecycle

Users are soft-deleted rather than permanently removed. Deleted users:
  • Cannot authenticate
  • Retain their resource assignments (for audit purposes)
  • Can be restored by a global administrator

​
Management UI

Platform includes a web-based management console built with Next.js. The UI provides:
  • User authentication (login, logout, password change)
  • Organization management (create, list, member administration)
  • Project management (create, list, IAM configuration)
  • Artifact Store integration (repository browsing, image details)
  • Global settings for administrators (user management, organization oversight)
The UI communicates with Platform APIs over REST, with authentication handled through secure cookies.

​
Quotas

Platform tracks resource usage and enforces limits at organization and project levels.

​
Quota dimensions

​
Enforcement

Quota checks occur during resource creation. When a limit is reached, the operation fails with a clear error indicating the exceeded quota and current usage. Administrators can view and adjust quotas through the API or management UI.

​
Configuration

​
Deployment

​
Requirements

Platform requires:
  • Access to a FoundationDB cluster
  • Network connectivity to DFS for artifact storage operations
  • A configured domain for cookie-based authentication

​
Initial setup

On first deployment, create an initial administrator:
  1. Start Platform with the required configuration
  2. Navigate to the setup page in the management UI
  3. Create the first user account (automatically granted global administrator)
Subsequent users are created through the User Admin Service or management UI.

​
High availability

Platform is stateless. Deploy multiple instances behind a load balancer for availability. All instances share the same FoundationDB cluster for consistent state. Session cookies are validated against FoundationDB, so users can authenticate through any instance.