Batch Reviewer

One governed identity, and the evidence a stranger can check.

Active

What Raidiam Connect holds

Entity identifier: https://catalogue.agents.showcase.raidiam.io/agents/batch-reviewer
Software statement: 8b55501e-e252-467c-bc34-c88c803e256d
Organisation: TARNBROOK-GROUP
Where it runs: self hosted; instances on the workload domain
Lifecycle: Active
Deployed: 2026-09-16T21:08:19.608Z, run run-8f14hs79

The entity identifier is the address this agent publishes its own signed record at. The software statement is the record Raidiam Connect holds for it, and every key and every role below hangs off that record.

Its own signed record

This agent publishes one signed document that describes itself. It is called an entity configuration. A stranger reads it to learn the agent's keys and what it says it is.

Read this agent’s signed record

Download the signed file. It is a JWT, so a browser saves it and shows nothing.

What the publisher signed about this build

This catalogue fetched the release record the publisher signed and checked its signature against the key set that publisher publishes. The values below come from that record.

Publisher: https://catalogue.agents.showcase.raidiam.io
Release record: https://catalogue.agents.showcase.raidiam.io/releases/batch-reviewer/1.3.0
Version: 1.3.0
Artefact digest: sha256:b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1
Digest of the signed record: sha256:f582ea08def8d84572bf39fa1ed6eb9aa42b856aa2ce7c3d2cd1022c4825c12e

Keys

A key id names one public key the directory publishes for this agent. A reader who checks a signature looks the key up by this value. This catalogue holds the private key for Tarnbrook Financial Group and never sends it anywhere. The agent holds no second key. Each running copy proves itself to the attester instead.

Key id	Profile	Status
`AVkvoFJFtyLEkfqAk-y6ntuCCV-cCelzc6u67dF_WxE`	rtssigning	Active
`0jE70x14TCeXjg0rYZoXXYWpB_kpa0Fxib2JoGiJWqc`	rtssigning	Active

3 earlier keys, kept for the record

Withdrawing this identity revokes the certificate of the key it was using. A revoked certificate cannot be brought back, so a restore issues a new key and the directory keeps the old one. Each row below is one of those.

Key id	Profile	Status
`fA4f_IZTnwU2z65AyJ7DVwBOIAwrAp-fFTk_XA-hSA4`	rtssigning	Inactive
`apsNcII8ZOWhAZmQvYzJHHfW7aYSmVW89JJabybLa1I`	rtssigning	Inactive
`4tYj5oE8K-T6RUNNXAU8-fNZ37SYyPcm6X90TrIVjT0`	rtssigning	Inactive

What the Tarnbrook Financial Group authority granted

Tarnbrook asked for the roles on the left. The authority signed a statement about this agent and set the limits on the right. A platform reads those limits before it lets the agent do anything.

Asked for

Asked of the Tarnbrook Financial Group authority.

tarnbrook.agent.member
tarnbrook.auth.attested
tarnbrook.records.reader
tarnbrook.resource
tarnbrook.review.actor

Granted, read at 2026-11-09T07:30:21.826Z

What it may ask a platform to do
The authority fixes this to
records.readrecords.annotate
Written in the statement as authorization_details_types.
The authority sets client_name
The authority fixes this to
Batch Reviewer
Written in the statement as client_name.
How it registers with a platform
The authority fixes this to
automatic
Written in the statement as client_registration_types.
How it may ask for a token
The authority fixes this to
client_credentialsauthorization_codeurn:ietf:params:oauth:grant-type:device_codeurn:ietf:params:oauth:grant-type:token-exchange
Written in the statement as grant_types.
The authority sets jwks_uri
The authority fixes this to
https://keystore.directory.showcase.raidiam.io/TARNBROOK-GROUP/8b55501e-e252-467c-bc34-c88c803e256d/application.jwks
Written in the statement as jwks_uri.
The authority sets logo_uri
The authority fixes this to
https://data.directory.showcase.raidiam.io/logos/TARNBROOK-GROUP/softwarestatements/8b55501e-e252-467c-bc34-c88c803e256d.png
Written in the statement as logo_uri.
Where a platform may send a person back to
The authority fixes this to
https://agents.showcase.raidiam.io/batch-reviewer/cb
Written in the statement as redirect_uris.
The authority sets sector_identifier_uri
The authority fixes this to
https://keystore.directory.showcase.raidiam.io/TARNBROOK-GROUP/8b55501e-e252-467c-bc34-c88c803e256d/redirect_uris.json
Written in the statement as sector_identifier_uri.
The authority sets software_version
The authority fixes this to
1
Written in the statement as software_version.
How it proves who it is when it asks for a token
The authority fixes this to
attest_jwt_client_auth
Written in the statement as token_endpoint_auth_method.

This statement carries no trust mark. A trust mark is a signed note from an authority saying an agent holds one role. This authority puts the marks it issued in the record it resolves, which the Chain section below asks for.

The record the authority signed, as it is written

{
  "authorization_details_types": {
    "value": [
      "records.read",
      "records.annotate"
    ]
  },
  "client_name": {
    "value": "Batch Reviewer"
  },
  "client_registration_types": {
    "value": [
      "automatic"
    ]
  },
  "grant_types": {
    "value": [
      "client_credentials",
      "authorization_code",
      "urn:ietf:params:oauth:grant-type:device_code",
      "urn:ietf:params:oauth:grant-type:token-exchange"
    ]
  },
  "jwks_uri": {
    "value": "https://keystore.directory.showcase.raidiam.io/TARNBROOK-GROUP/8b55501e-e252-467c-bc34-c88c803e256d/application.jwks"
  },
  "logo_uri": {
    "value": "https://data.directory.showcase.raidiam.io/logos/TARNBROOK-GROUP/softwarestatements/8b55501e-e252-467c-bc34-c88c803e256d.png"
  },
  "redirect_uris": {
    "value": [
      "https://agents.showcase.raidiam.io/batch-reviewer/cb"
    ]
  },
  "sector_identifier_uri": {
    "value": "https://keystore.directory.showcase.raidiam.io/TARNBROOK-GROUP/8b55501e-e252-467c-bc34-c88c803e256d/redirect_uris.json"
  },
  "software_version": {
    "value": "1"
  },
  "token_endpoint_auth_method": {
    "value": "attest_jwt_client_auth"
  }
}

Running copies

1 running, 0 stopped, read from the attester. The attester is the service a running copy proves itself to.

Open the runtime screen

Check the chain yourself

A chain is the path from this agent up to the anchor this estate trusts. Ask the Tarnbrook Financial Group authority to walk that path and read what it answers.

See the resolved evidence Ask the authority to resolve this agent Run the independent checks

The request, to run yourself

Run this with curl. A browser saves the answer as a file, because the answer is a signed JWT.

https://authority.directory.showcase.raidiam.io/authority/845f7286-3c74-4d91-9354-af110dbd33c8/resolve?sub=https%3A%2F%2Fcatalogue.agents.showcase.raidiam.io%2Fagents%2Fbatch-reviewer&trust_anchor=https%3A%2F%2Ffederation.directory.showcase.raidiam.io%2Ffederation_entity%2F7b60c9fa-00dd-46d9-80de-cd899ee5a58d&entity_type=openid_relying_party

Lifecycle

Withdrawing this identity revokes its certificate, sets every role it holds Inactive and withdraws the identity in Raidiam Connect. It then asks the attester to stop every instance of this agent that the attester knows of. The Tarnbrook Financial Group authority stops listing the agent within seconds. It is reversible: Restore puts it back.

A control on this screen that writes changes a real record in Raidiam Connect.

What a withdrawal reaches, and how soon

The authority stops listing this agent at its next read.
The authority publishes one signed statement about this agent, called a subordinate statement. It carries the agent's keys and the limits above. The authority issues that statement again with the limits empty, about a minute after a withdrawal on this tenant.
A platform keeps the answer it resolved until that statement expires, then asks again. The statement prints the time it expires.
Revoking the certificate reaches the key set the authority publishes.
This catalogue asks the attester to stop every instance of this agent that the attester knows of. The attester publishes one bit per instance and that bit lasts 60 seconds.
Where a platform subscribes to the record change webhook, the change arrives as an event.