{
  "id": "stack-part:krate-identity-engine",
  "_kind": "StackPart",
  "_file": "domain/products/krate-components.yaml",
  "_cluster": "domain",
  "attributes": {
    "displayName": "Krate Identity Engine",
    "category": "security",
    "description": "Handles OIDC/OAuth sign-in, maps external identities to Kubernetes\nusers and groups via IdentityMapping CRDs, and evaluates Kubernetes\nRBAC policy for every API call. Issues scoped ServiceAccount tokens\nfor CI jobs and agent dispatch attempts. Manages User, Team, Invite,\nAuthProvider, AgentServiceAccount, and AgentRoleBinding resources\nto ensure the forge never creates a parallel permission system.\n"
  },
  "outgoingEdges": [
    {
      "from": "stack-part:krate-identity-engine",
      "to": "layer:6-agent-platform",
      "kind": "realizes",
      "attributes": {
        "notes": "Identity and RBAC enforcement layer"
      }
    },
    {
      "from": "stack-part:krate-identity-engine",
      "to": "platform:krate",
      "kind": "part_of",
      "attributes": {
        "notes": "Krate identity engine component"
      }
    }
  ],
  "incomingEdges": []
}