Authorization
Who can reach the platform and act inside the Company Runtime.
Two layers
Continual separates platform access from business authorization because the platform and each customer-owned Company Runtime control different things.
Platform access
A platform membership gives a principal a role at an allowed scope in Continual's resource hierarchy.
- A principal is a user, service account, or group.
- A role is a named set of platform permissions.
- A scope is the platform resource where the grant applies.
A role can be granted only at the kinds of scope it was designed for. A root administrator role, for example, cannot be applied inside one project. Groups are principals, so group membership and resource access remain separate concerns.
Business authorization
Business authorization is source-owned policy over the verified actor, object, tool, and transaction. The backend applies it to generated object tools and customer-defined tools.
Platform membership answers whether a principal may reach and administer a project. Business policy answers what that principal may see and do inside the customer-defined system. Neither creates a private agent bypass. See Tools for the shared invocation path.
Agents are principals
An agent authenticates as a principal. Its memberships determine which projects and platform capabilities it can reach; business policy governs the tools it can use. Native and external agents pass the same server-side checks as people and apps.