TARNBROOKFINANCIAL GROUP

Analyst Companion

One governed identity, and the evidence a stranger can check.

Active

What Raidiam Connect holds

Entity identifier
https://catalogue.agents.showcase.raidiam.io/agents/analyst-companion
Software statement
e1545ece-3890-498f-ad34-f1ca9460f81d
Organisation
TARNBROOK-GROUP
Where it runs
self hosted; one instance on a workstation
Lifecycle
Active
Deployed
2026-09-16T21:10:00.747Z, run run-ti9t3b52

The entity identifier is the address this agent publishes its own signed record at. The software statement is the record Raidiam Connect holds for it, and every key and every role below hangs off that record.

Its own signed record

This agent publishes one signed document that describes itself. It is called an entity configuration. A stranger reads it to learn the agent's keys and what it says it is.

Read this agent’s signed record

Download the signed file. It is a JWT, so a browser saves it and shows nothing.

What the publisher signed about this build

This catalogue fetched the release record the publisher signed and checked its signature against the key set that publisher publishes. The values below come from that record.

Publisher
https://catalogue.agents.showcase.raidiam.io
Release record
https://catalogue.agents.showcase.raidiam.io/releases/analyst-companion/0.9.1
Version
0.9.1
Artefact digest
sha256:c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1
Digest of the signed record
sha256:43c5fbfa6f71c9ff4da6ae1e3ac772df0fc3a7bcb9f16e21cf950b5516c5911e

Keys

A key id names one public key the directory publishes for this agent. A reader who checks a signature looks the key up by this value. This catalogue holds the private key for Tarnbrook Financial Group and never sends it anywhere. The agent holds no second key. Each running copy proves itself to the attester instead.

Key idProfileStatus
TnwsaMAXzVrFASXMUU9zDqxHyitt6UU799tKqQrzWwQ rtssigning Active
38 earlier keys, kept for the record

Withdrawing this identity revokes the certificate of the key it was using. A revoked certificate cannot be brought back, so a restore issues a new key and the directory keeps the old one. Each row below is one of those.

Key idProfileStatus
knjPecTn6BkZ3WyZMZ1HAr1HXD8eI9E1mLWcrofeWew rtssigning Inactive
UBKCnE3VaUW5LAxXRzB6KkuWo8hegS6amQC447e3vk4 rtssigning Inactive
1juV2JXr-SbXamu9Ssfw4seTAnyLwinvpdikFzlQ18A rtssigning Inactive
GGM_454Y7P5lchjY2vOQQSBQeFe7lhzSD4rl7Pt0R4o rtssigning Inactive
WLmpci2mzvgw6TlFyVRvo_qiExs7pQ2hWS3azzxtFnc rtssigning Inactive
R7vr2uBCIfHNcz2ykbkgxt4i7d4ATvo8kRdPUSc6XmY rtssigning Inactive
ckrMjMqzsa1_7U8NTrHSG-6YGmiKGs6wBu6BfnhoJ6M rtssigning Inactive
uOQU0DxHNGTEc8ZmpRL7Nj40Kz_xylEOld4Gd_159sI rtssigning Inactive
WLaN6jMdm85X9d-9HblxBM6C487acoXS0fmdofvIpWg rtssigning Inactive
8xzD2VqLd0CghdD8au_6IYD_ctRfRFymS7UEvq2MWUE rtssigning Inactive
D93pjZ4bQl-pc-OQNng43pKWWE1imPSZZE_vgBlXXcE rtssigning Inactive
D152bglQNtYPEYBS568IxjoEm597w3qRqPvgWWSE2fw rtssigning Inactive
XeN8OtBqZyC-Ay79XWLakxIHjkTr0S2mF_TV1w3B5oQ rtssigning Inactive
OatyVi5V51fXfcNmLBjp_Zuu0I8CFq9SX8xOZZXz9oU rtssigning Inactive
9--39ELEG2_1YYG9VVRdmH4zm7Gr8B2qhTFKmcC9Qws rtssigning Inactive
1e-_U2NP0RlTLWe2tEj1O_FSuSY1NMFcw9Em08_NlY8 rtssigning Inactive
KIBV3m7bQzt-hliHb9fcNtWBGn_IWbvKdV6ZQhnHPOA rtssigning Inactive
vKZKw6JS51eaMI6gSizrZ0zm9xd35jSM0eD7seaP2Jk rtssigning Inactive
NYh_gjLQ0zWGP_W6AmNY-yVWaLVBM5KliSKoyQ1FTjo rtssigning Inactive
lCOxs2UGkrQSBeSTgasZ70Ugn-HgKPL0PeJFQRAaANs rtssigning Inactive
OMnJkwwxsS6BiB-PyBtERLaZNPQrEaqQl3tDjETnV3Y rtssigning Inactive
z-4buYqUlesROoAUelu4-uY8eBbO8woIeGaAFsSLFmE rtssigning Inactive
KIP7YmEA_SVZrfnzzEpMhp8_jLRw1fLuh-tMqW2_dSc rtssigning Inactive
kjOzfYwqwVFW3czqZmGKuq5AB4GoANaBq57JPfl9ycQ rtssigning Inactive
h7_cDGLku4LHFGwNeKeBDyw3PV0c60soa18lwXocSj0 rtssigning Inactive
lIzDg34-3o3wa3FGtuZWfJtZYuKa-t9t3lY16KjwOEw rtssigning Inactive
wLbirZKp09RYiUK5X_o2UTl1_nAZpHs38HFid5kQc8w rtssigning Inactive
r2_vP2c8lZSMysypTss7DNVSJoCn7dv3phH046Oe2sM rtssigning Inactive
6Bxx-kYMdcg8g-MqzwP8TQn_oNvbd_qYlMn5kOdq8AA rtssigning Inactive
iU06xckNgYuWjvCWK8Yl5slZGmS5rKHLt6lqYc57tEY rtssigning Inactive
60KDn2eJYe0IlYEHpiZPZw9X0rQDis31VOSjB5nn3KU rtssigning Inactive
Yu2W_NyShVvSrB6w-k4tGTv2r6i48o8oqQZXmFrP5xM rtssigning Inactive
1Jfa_gRtIYEb5eVyZ6r3JtYJDHBr4UMbeaiOEHsLCrE rtssigning Inactive
9GDq504QWZvsq6LFVC55OeLyfR1jtycjDzMW2R8O9uY rtssigning Inactive
eqmDSMxzlw7PkEEkvrAXf8oIpz8PZNCrgH8ngL4WXOk rtssigning Inactive
ABjyFMjNlBzhxLBJMyXUgNJb0QRXFh8PCVym2faOF88 rtssigning Inactive
wIsksY_ofr2x_6oXmduQ21bFgRPrN8Yg7aDXO4AqEE4 rtssigning Inactive
n4q78YywTUUfeSJQCxnn2ZwiguordIRknNtgeYfkuW4 rtssigning Inactive

What the Tarnbrook Financial Group authority granted

Tarnbrook asked for the roles on the left. The authority signed a statement about this agent and set the limits on the right. A platform reads those limits before it lets the agent do anything.

Asked for

Asked of the Tarnbrook Financial Group authority.

  • tarnbrook.agent.member
  • tarnbrook.auth.attested
  • tarnbrook.records.reader
  • tarnbrook.review.caller

Granted, read at 2026-11-09T07:30:21.819Z

  • What it may ask a platform to do

    The authority fixes this to

    records.readrecords.annotatereview.submit

    Written in the statement as authorization_details_types.

  • The authority sets client_name

    The authority fixes this to

    Analyst Companion

    Written in the statement as client_name.

  • How it registers with a platform

    The authority fixes this to

    automatic

    Written in the statement as client_registration_types.

  • How it may ask for a token

    The authority fixes this to

    client_credentialsauthorization_codeurn:ietf:params:oauth:grant-type:device_code

    Written in the statement as grant_types.

  • The authority sets jwks_uri

    The authority fixes this to

    https://keystore.directory.showcase.raidiam.io/TARNBROOK-GROUP/e1545ece-3890-498f-ad34-f1ca9460f81d/application.jwks

    Written in the statement as jwks_uri.

  • The authority sets logo_uri

    The authority fixes this to

    https://data.directory.showcase.raidiam.io/logos/TARNBROOK-GROUP/softwarestatements/e1545ece-3890-498f-ad34-f1ca9460f81d.png

    Written in the statement as logo_uri.

  • Where a platform may send a person back to

    The authority fixes this to

    https://agents.showcase.raidiam.io/analyst-companion/cb

    Written in the statement as redirect_uris.

  • The authority sets sector_identifier_uri

    The authority fixes this to

    https://keystore.directory.showcase.raidiam.io/TARNBROOK-GROUP/e1545ece-3890-498f-ad34-f1ca9460f81d/redirect_uris.json

    Written in the statement as sector_identifier_uri.

  • The authority sets software_version

    The authority fixes this to

    1

    Written in the statement as software_version.

  • How it proves who it is when it asks for a token

    The authority fixes this to

    attest_jwt_client_auth

    Written in the statement as token_endpoint_auth_method.

This statement carries no trust mark. A trust mark is a signed note from an authority saying an agent holds one role. This authority puts the marks it issued in the record it resolves, which the Chain section below asks for.

The record the authority signed, as it is written
{
  "authorization_details_types": {
    "value": [
      "records.read",
      "records.annotate",
      "review.submit"
    ]
  },
  "client_name": {
    "value": "Analyst Companion"
  },
  "client_registration_types": {
    "value": [
      "automatic"
    ]
  },
  "grant_types": {
    "value": [
      "client_credentials",
      "authorization_code",
      "urn:ietf:params:oauth:grant-type:device_code"
    ]
  },
  "jwks_uri": {
    "value": "https://keystore.directory.showcase.raidiam.io/TARNBROOK-GROUP/e1545ece-3890-498f-ad34-f1ca9460f81d/application.jwks"
  },
  "logo_uri": {
    "value": "https://data.directory.showcase.raidiam.io/logos/TARNBROOK-GROUP/softwarestatements/e1545ece-3890-498f-ad34-f1ca9460f81d.png"
  },
  "redirect_uris": {
    "value": [
      "https://agents.showcase.raidiam.io/analyst-companion/cb"
    ]
  },
  "sector_identifier_uri": {
    "value": "https://keystore.directory.showcase.raidiam.io/TARNBROOK-GROUP/e1545ece-3890-498f-ad34-f1ca9460f81d/redirect_uris.json"
  },
  "software_version": {
    "value": "1"
  },
  "token_endpoint_auth_method": {
    "value": "attest_jwt_client_auth"
  }
}

Running copies

0 running, 0 stopped, read from the attester. The attester is the service a running copy proves itself to.

Open the runtime screen

Check the chain yourself

A chain is the path from this agent up to the anchor this estate trusts. Ask the Tarnbrook Financial Group authority to walk that path and read what it answers.

See the resolved evidence Ask the authority to resolve this agent Run the independent checks

The request, to run yourself

Run this with curl. A browser saves the answer as a file, because the answer is a signed JWT.

https://authority.directory.showcase.raidiam.io/authority/845f7286-3c74-4d91-9354-af110dbd33c8/resolve?sub=https%3A%2F%2Fcatalogue.agents.showcase.raidiam.io%2Fagents%2Fanalyst-companion&trust_anchor=https%3A%2F%2Ffederation.directory.showcase.raidiam.io%2Ffederation_entity%2F7b60c9fa-00dd-46d9-80de-cd899ee5a58d&entity_type=openid_relying_party

Lifecycle

Withdrawing this identity revokes its certificate, sets every role it holds Inactive and withdraws the identity in Raidiam Connect. It then asks the attester to stop every instance of this agent that the attester knows of. The Tarnbrook Financial Group authority stops listing the agent within seconds. It is reversible: Restore puts it back.

A control on this screen that writes changes a real record in Raidiam Connect.

What a withdrawal reaches, and how soon
  • The authority stops listing this agent at its next read.
  • The authority publishes one signed statement about this agent, called a subordinate statement. It carries the agent's keys and the limits above. The authority issues that statement again with the limits empty, about a minute after a withdrawal on this tenant.
  • A platform keeps the answer it resolved until that statement expires, then asks again. The statement prints the time it expires.
  • Revoking the certificate reaches the key set the authority publishes.
  • This catalogue asks the attester to stop every instance of this agent that the attester knows of. The attester publishes one bit per instance and that bit lasts 60 seconds.
  • Where a platform subscribes to the record change webhook, the change arrives as an event.