TARNBROOKFINANCIAL GROUP

Balance Monitor

One governed identity, and the evidence a stranger can check.

Active

What Raidiam Connect holds

Entity identifier
https://catalogue.agents.showcase.raidiam.io/agents/balance-monitor
Software statement
1523e2f0-af08-459e-bb79-51c93d73023f
Organisation
TARNBROOK-GROUP
Where it runs
self hosted at this catalogue
Lifecycle
Active
Deployed
2026-09-24T12:41:05.220Z, run run-1co2c45t

The entity identifier is the address this agent publishes its own signed record at. The software statement is the record Raidiam Connect holds for it, and every key and every role below hangs off that record.

Its own signed record

This agent publishes one signed document that describes itself. It is called an entity configuration. A stranger reads it to learn the agent's keys and what it says it is.

Read this agent’s signed record

Download the signed file. It is a JWT, so a browser saves it and shows nothing.

What the publisher signed about this build

This catalogue fetched the release record the publisher signed and checked its signature against the key set that publisher publishes. The values below come from that record.

Publisher
https://quillon-production-ff3b.up.railway.app
Release record
https://quillon-production-ff3b.up.railway.app/releases/balance-monitor/2.4.0
Version
2.4.0
Artefact digest
sha256:9c1f2b7d4e6a8053c2d1e0f7b6a5948372615049d8c7b6a5f4e3d2c1b0a99887
Digest of the signed record
sha256:acb0829349ca1da8253de374c85b1226dcac47ae8f6ad7cfcdb90d86e082f381

Keys

A key id names one public key the directory publishes for this agent. A reader who checks a signature looks the key up by this value. This catalogue holds the private key for Tarnbrook Financial Group and never sends it anywhere. The agent signs with a second key, EzO4rgIV9YnRIAOIoZlr6ZBa59TD33ZCHYnWxsvnIMI, when it proves who it is to a token endpoint.

Key idProfileStatus
EzO4rgIV9YnRIAOIoZlr6ZBa59TD33ZCHYnWxsvnIMI rtssigning Active
J5DJSCJ0O1jEcr233F5czuWmnWhdlmJwMFFK59Ljk3M rtssigning Active
34 earlier keys, kept for the record

Withdrawing this identity revokes the certificate of the key it was using. A revoked certificate cannot be brought back, so a restore issues a new key and the directory keeps the old one. Each row below is one of those.

Key idProfileStatus
_mGGDqf4FXJUvVHo1wfPpjbzsEQyZ9JPLCL-xtXKmlw rtssigning Inactive
23EWuFqzLvpiWQ1vuB1J880jZ32N6lLhiRgGckZ7md0 rtssigning Inactive
uW3lwIHMRXt25zsG-4UuM_dFsBF4isl5jWVt15Yetwo rtssigning Inactive
wG-PdMcIzFkt_CAKw2lI-0ZTGjIDEAmzsZxSePMGvAM rtssigning Inactive
5p1hrvbufFMQetDYL10RCthpnV_oAc2RT__ufaLy4Ko rtssigning Inactive
9KGOCLAJsqipIBzMb7Iv1F4IogWj0sOchIeWM-L7QO4 rtssigning Inactive
QlFriIqBjjjSYsVAMZBfufOPE6iynrdw-Ix10yo0gN8 rtssigning Inactive
8RLvhDyiJDvJq-s9rwfLSRh_wK1Xl0wvd09at5IBI_o rtssigning Inactive
kHiZZDUkhv8WtUCYmGzOAiB1LRRAXRAtYrQtk2e4l2E rtssigning Inactive
uJX8m_UqJiM1t12M7bE7LN8ypmfpJKJUxXsSIfexLTU rtssigning Inactive
c8tbSNp0UuDP5R_uy0bhsNFCvDJs0tATtECwQB4vSWM rtssigning Inactive
tqR2eIHHDJgPca5w7SUlZkGSfynke97pHc8x-G7s-4k rtssigning Inactive
njLPsDCeenMQzFArjE1z3vC7w-4gyQpbMxXxi7fpaqU rtssigning Inactive
FPaMa1LOUrDW1f5ZkkA2pFeefRQasJqDjMViLI_3sFM rtssigning Inactive
HMleinQsmvWvFiIFGfwXfMmnmG0pO2oG76dDnJGBYzw rtssigning Inactive
pAZzhbA-hPt0-xybevg6gDreh9hh0RomWXj-MUxW8H4 rtssigning Inactive
UsOSoRvMyYi2iIc4v9vHDeC_kDfh6Iw3pizt3YnlhGY rtssigning Inactive
sGkIJmhUxAqOpVhM8hOUap_gfVHLte9ZpJ23iBWu5FI rtssigning Inactive
v5W6fO97KMNeFvs3tukH86m5Bv7QqjjjeUJQ-p7CgiQ rtssigning Inactive
Li63zohXBEWQYZv3a-3eCXBEz9Gz4IHsUkcb1GyA05I rtssigning Inactive
CbLge92P_berUzQF4LYrDYGSojC-pW6l9WV40TxAfS0 rtssigning Inactive
Njyj3F-D8ilJFGm-EH3DDOjApfa1ogdUxYGfoEFM_RM rtssigning Inactive
4HHgaZEX_d6OpRW39Tt9JKaJu8OdYMsEqFESHzQ1ph8 rtssigning Inactive
GkgcbZ0ehTHVJ6iBZvL1EnK7lOswtKyAzIQ0RvVavbw rtssigning Inactive
WjRgrkMoawsxflMWnmU5NBzaAjjeddZBrcv6sINX8QM rtssigning Inactive
PFuKA4szxsHoiM7XU9SGdR6JLMTkBgn9xO8mEqicx74 rtssigning Inactive
8hOCjzz0z9ol_kQF4wyL8Or2k4EB5CJK3QC0pW6IgEg rtssigning Inactive
Bf2adrtkl_dbRzOshnyGvWJ0LA9foX3x6rf67azWQlU rtssigning Inactive
30KMIfJOiwYTOApc0zjbPfuQW3pyjDTEBYnVhGGo3is rtssigning Inactive
925n77MlexrwB73Of6erTcmj1mlcHZzyb-UJY5QtfIs rtssigning Inactive
Z5XB-GrJZ5KiDjV9-9VmEsd0LyCpjT4G3GoPyRTKpk8 rtssigning Inactive
iNiy5h-MNFii1e99xCLpgPLqA_MpfWc5FdgBWnRevoo rtssigning Inactive
CDqwn_Y96GRVbPqgzEp2BiE91c2aDGTlv4EEYE4USXg rtssigning Inactive
7SrOy_2dfrODRp1aE_9o2B4ljyQa9yKnQHC_KtwQLIs rtssigning Inactive

What the Tarnbrook Financial Group authority granted

Tarnbrook asked for the roles on the left. The authority signed a statement about this agent and set the limits on the right. A platform reads those limits before it lets the agent do anything.

Asked for

Asked of the Tarnbrook Financial Group authority.

  • tarnbrook.agent.member
  • tarnbrook.auth.assertion
  • tarnbrook.records.reader
  • tarnbrook.review.caller

Granted, read at 2026-11-09T07:30:24.155Z

  • What it may ask a platform to do

    The authority fixes this to

    records.readrecords.annotatereview.submit

    Written in the statement as authorization_details_types.

  • The authority sets client_name

    The authority fixes this to

    Balance Monitor

    Written in the statement as client_name.

  • How it registers with a platform

    The authority fixes this to

    automatic

    Written in the statement as client_registration_types.

  • The authority sets client_uri

    The authority fixes this to

    https://catalogue.agents.showcase.raidiam.io/catalogue/balance-monitor

    Written in the statement as client_uri.

  • How it may ask for a token

    The authority fixes this to

    client_credentialsauthorization_codeurn:ietf:params:oauth:grant-type:device_code

    Written in the statement as grant_types.

  • The authority sets jwks_uri

    The authority fixes this to

    https://keystore.directory.showcase.raidiam.io/TARNBROOK-GROUP/1523e2f0-af08-459e-bb79-51c93d73023f/application.jwks

    Written in the statement as jwks_uri.

  • The authority sets logo_uri

    The authority fixes this to

    https://data.directory.showcase.raidiam.io/logos/TARNBROOK-GROUP/softwarestatements/1523e2f0-af08-459e-bb79-51c93d73023f.png

    Written in the statement as logo_uri.

  • Where a platform may send a person back to

    The authority fixes this to

    https://agents.showcase.raidiam.io/balance-monitor/cb

    Written in the statement as redirect_uris.

  • The authority sets sector_identifier_uri

    The authority fixes this to

    https://keystore.directory.showcase.raidiam.io/TARNBROOK-GROUP/1523e2f0-af08-459e-bb79-51c93d73023f/redirect_uris.json

    Written in the statement as sector_identifier_uri.

  • The authority sets software_version

    The authority fixes this to

    1

    Written in the statement as software_version.

  • How it proves who it is when it asks for a token

    The authority fixes this to

    private_key_jwt

    Written in the statement as token_endpoint_auth_method.

This statement carries no trust mark. A trust mark is a signed note from an authority saying an agent holds one role. This authority puts the marks it issued in the record it resolves, which the Chain section below asks for.

The record the authority signed, as it is written
{
  "authorization_details_types": {
    "value": [
      "records.read",
      "records.annotate",
      "review.submit"
    ]
  },
  "client_name": {
    "value": "Balance Monitor"
  },
  "client_registration_types": {
    "value": [
      "automatic"
    ]
  },
  "client_uri": {
    "value": "https://catalogue.agents.showcase.raidiam.io/catalogue/balance-monitor"
  },
  "grant_types": {
    "value": [
      "client_credentials",
      "authorization_code",
      "urn:ietf:params:oauth:grant-type:device_code"
    ]
  },
  "jwks_uri": {
    "value": "https://keystore.directory.showcase.raidiam.io/TARNBROOK-GROUP/1523e2f0-af08-459e-bb79-51c93d73023f/application.jwks"
  },
  "logo_uri": {
    "value": "https://data.directory.showcase.raidiam.io/logos/TARNBROOK-GROUP/softwarestatements/1523e2f0-af08-459e-bb79-51c93d73023f.png"
  },
  "redirect_uris": {
    "value": [
      "https://agents.showcase.raidiam.io/balance-monitor/cb"
    ]
  },
  "sector_identifier_uri": {
    "value": "https://keystore.directory.showcase.raidiam.io/TARNBROOK-GROUP/1523e2f0-af08-459e-bb79-51c93d73023f/redirect_uris.json"
  },
  "software_version": {
    "value": "1"
  },
  "token_endpoint_auth_method": {
    "value": "private_key_jwt"
  }
}

Running copies

This agent runs without an attested copy, because the operator holds its key.

Open the runtime screen

Check the chain yourself

A chain is the path from this agent up to the anchor this estate trusts. Ask the Tarnbrook Financial Group authority to walk that path and read what it answers.

See the resolved evidence Ask the authority to resolve this agent Run the independent checks

The request, to run yourself

Run this with curl. A browser saves the answer as a file, because the answer is a signed JWT.

https://authority.directory.showcase.raidiam.io/authority/845f7286-3c74-4d91-9354-af110dbd33c8/resolve?sub=https%3A%2F%2Fcatalogue.agents.showcase.raidiam.io%2Fagents%2Fbalance-monitor&trust_anchor=https%3A%2F%2Ffederation.directory.showcase.raidiam.io%2Ffederation_entity%2F7b60c9fa-00dd-46d9-80de-cd899ee5a58d&entity_type=openid_relying_party

Lifecycle

Withdrawing this identity revokes its certificate, sets every role it holds Inactive and withdraws the identity in Raidiam Connect. It then asks the attester to stop every instance of this agent that the attester knows of. The Tarnbrook Financial Group authority stops listing the agent within seconds. It is reversible: Restore puts it back.

A control on this screen that writes changes a real record in Raidiam Connect.

What a withdrawal reaches, and how soon
  • The authority stops listing this agent at its next read.
  • The authority publishes one signed statement about this agent, called a subordinate statement. It carries the agent's keys and the limits above. The authority issues that statement again with the limits empty, about a minute after a withdrawal on this tenant.
  • A platform keeps the answer it resolved until that statement expires, then asks again. The statement prints the time it expires.
  • Revoking the certificate reaches the key set the authority publishes.
  • This catalogue asks the attester to stop every instance of this agent that the attester knows of. The attester publishes one bit per instance and that bit lasts 60 seconds.
  • Where a platform subscribes to the record change webhook, the change arrives as an event.