Architecture
System design, module structure, and core design decisions.
Atom is a single Rust service backed by one Postgres database. It centralizes identity, credentials, authorization, certificates, and audit history.
System Diagram
What this means: applications and operators talk to Atom through HTTP, GraphQL, or gRPC. Atom stores identity, authorization, and managed certificate authority state in Postgres. CA private keys are envelope-encrypted in Postgres by default; an authority can instead reference a non-exportable key in a PKCS#11 HSM. The production root private key remains offline.
Main Parts
| Part | Job |
|---|---|
| Identity | Stores entities such as users, devices, services, workloads, and applications. |
| Credentials | Stores password hashes, access-token hashes, scoped-token ceilings, and issued certificate records. |
| Authorization | Answers live access questions using actions, permission blocks, roles, assignments, direct policies, groups, and conditions. |
| Certificates | Manages authorities, issues certificates, signs CSRs, revokes certificates, serves the trust bundle and per-issuer CRL/OCSP artifacts, and resolves runtime certificate identity. |
| Audit | Records important security events without blocking the main request; successful high-volume authz/auth allows can stay in metrics/traces by policy. |
| API Endpoint Builder | Lets admins expose controlled custom HTTP endpoints backed by Atom GraphQL. |
Request Layers
Every request follows the same shape:
Handlers deal with HTTP, GraphQL, or gRPC details. Services and engines contain business rules. Repositories run SQL and return domain types.
Online Authorization
Tokens prove identity only. They do not contain permissions.
When a service needs an access decision, it asks Atom at runtime. Atom checks the current database state and returns allow or deny. That means role changes, revocations, and deny rules take effect without issuing a new token.
Managed Certificate Authorities
Root and platform-intermediate bootstrap are deployment configuration, not a separate runtime issuer. At startup Atom imports the public root certificate and a pre-signed platform intermediate certificate plus its matching key into the managed authority registry. The root private key never enters Atom.
Managed tenant and platform leaf issuers sign leaf certificates and their own CRL/OCSP artifacts. Issued leaves are stored as credential rows. Leaf private keys generated by Atom are returned once and never stored.
Deployment Shape
Atom is intentionally small:
- one binary;
- one Postgres database;
- optional Next.js UI;
- optional PKCS#11 HSM for non-exportable managed CA keys;
- no OpenBao;
- no separate Magistrala certificate service.