feat(realm): add the Assistant client and its audience scope

Browse Source

The orchestrator is its own client so the exchanged token carries azp = the
agent doing the asking. It is granted two optional scopes — the Catalogue
agent's audience, and llm-proxy-audience because it has to reason — and no
domain audience at all. Every mcp-* and *-api scope it could request comes back
Invalid scopes, which is what makes 'the orchestrator holds nothing' a property
of the realm rather than a line in a prompt.

Note for the next client added by hand: CLIENT.DESCRIPTION is varchar(255), and
a longer one crash-loops the import with 'value too long' rather than a
validation message.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

...

This commit is contained in:

Stéphane Tailland

2026-08-29 12:27:47 +02:00

parent eed8c3da3b

commit 7e7e9d741b

1 changed files with 1 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

k8s/keycloak/configmap-realm.yaml

+1 -1

File diff suppressed because one or more lines are too long