Skip to main content

Current vs future

TrustPlane Auth is an OSS/customer-side runtime for proof-bound machine authorization. This page separates what works today from future compatibility and managed-governance work.

Works today​

  • Local TrustPlane Passport issuance and verification.
  • transcript-v1 request binding and proof verification.
  • Atomic replay consume-on-accept, including Redis-backed shared replay state.
  • Route policy, allowed sources, signer-class policy, provenance/context hooks, and bundle freshness.
  • Brownfield adapter in front of an existing API.
  • Local broker issuing request-bound passports.
  • SPIFFE/SPIRE attested_workload profile for configured workload-identity paths.
  • OIDC/JWKS-style source support as software-class policy acceptance.
  • Local signed trust material and signed policy bundles.
  • Bundle merge, removal, signing, verification, and refresh workflows.
  • Deterministic local acceptance gate through make v01-acceptance.

Future / not in current Auth core​

  • Backend-facing JWT/JWKS assertion tier (backend_jwt).
  • OAuth compatibility egress (oauth_compat_egress) for selected third-party providers.
  • OAuth token exchange, introspection, DPoP, HTTP Message Signatures, and discovery endpoints as runtime bridges.
  • SDK extraction and package publishing.
  • MCP or workflow integration packages.
  • Hosted Control governance, managed bundle distribution, hosted revocation, tenant registry, approval workflow, RBAC, and audit UI.
  • Production docs publishing pipeline and custom-domain deployment.

The important boundary​

TrustPlane Auth can protect APIs without a hosted service. TrustPlane Control is future fleet-governance packaging for teams that need managed signing, distribution, revocation, audit evidence, approvals, policy history, and status across many Auth deployments.