Local identity validation environment
Enterprise Identity Validation
Demonstrates the identity operating pattern BP Sphere needs for agents: Entra-compatible workload identity,
app-role authorization, SCIM/JIT lifecycle, temporary privileged access, cloud role exchange, and immutable audit events.
This local validation environment uses representative adapters. Production integration still requires BP tenant app
registration, consent, conditional access, SCIM/JIT rules, audit sink, and privileged-access controls.
Local Entra-compatible OIDC issuer
JWKS endpoint
SCIM lifecycle
Privileged access
AWS STS style exchange
Audit sink
Simulation Flow
1. AgentCertified agent family requests work.
2. TokenLocal OIDC token includes identity, roles, scope, policy, expiry.
3. AuthoritySecurity gateway checks role, boundary, classification, policy.
4. AccessTemporary access is approved only inside certified scope.
5. Role ExchangeCloud role credentials are short-lived and redacted.
6. AuditEvery step emits a replayable audit event.
Live Result
Click a simulation action to inspect the runtime contract.
Production Swap Contract
Identity providerReplace local validation issuer and JWKS with BP Entra tenant metadata, app registrations, admin consent, and conditional-access posture.
Provisioning lifecycleReplace SCIM/JIT events with BP identity lifecycle rules for agent service principals, owners, deputies, and certification status.
Privileged accessReplace temporary access simulation with BP-approved privileged-access workflow, approval evidence, expiry, and SIEM export.
Cloud federationReplace AWS STS simulation with approved workload federation into AWS/Azure roles scoped by mission, source system, and action boundary.
Workshop Checks
| Question | Simulation proof |
|---|---|
| How is an agent identified? | Token claims include subject, identity, agent ID, roles, scope, audience, expiry, policy, and correlation. |
| How are actions restricted? | Authority check returns allow, human-approval required, or deny based on app role and denied boundary. |
| How is access time-bound? | Temporary access and STS credentials include short expiry and audit events. |
| How is this audited? | Every token, authority check, lifecycle event, access grant, and role exchange is written to the audit stream. |
| What is not claimed? | This is not connected to BP production Entra, AWS, CyberArk, or SIEM. It proves the required runtime contract. |
Critical boundary
Posting journals, moving funds, modifying vendor master data, and releasing payments remain denied in the simulation unless explicitly certified for controlled autonomy.