Release pipeline to deployment API
Let a pipeline authenticate to the protected public L7 endpoint, then authorize its workload identity with a compatible Consumer Grant.
Workloads & Scoped Sharing
Give every non-human and outside user the smallest useful path.
Identify CI, automation and agents when they call an explicitly published L7 application, then authorize that workload identity with an enabled compatible Consumer Grant. For external people, grant only the approved Node or private Service inside the selected Space.
Workload → public L7 + GrantPartner → explicit GrantNo broad network identity
Two scoped pathsExplicit
WorkloadCredential and Grant accepted for this application
release-pipelineWorkload identity · credential
deploy.example.comPublic L7 · Consumer Grant enabled
External personNo access to other resources
Support partnerSigned-in user
One Service GrantTCP · support.internal · 8443
Common situations
Automation and collaboration without turning either into a network-wide credential.
The identity type and the resource type stay aligned: workload credentials authenticate to published L7 applications and compatible Consumer Grants authorize them; people consume explicit Node or Service Grants.
Scheduled integration
Give a non-human process an application-level identity for one explicitly published API.
AI or operations agent
Constrain an agent to the public L7 application designed for it instead of handing it private network reach.
External support and collaboration
Grant a signed-in person directional access to one approved Node or one declared private Service.
Identity is not reachability
Each identity gets only the resource model built for it.
The boundary is deliberate. A workload credential does not become a private-overlay client, and a partner Grant does not expand beyond its destination.
Public L7 only
Workload identities authenticate to published L7 applications; an enabled compatible Consumer Grant separately authorizes access. They do not join the private overlay.
No private Node or Service consumption
A workload identity is not used to consume private L3 Nodes or private L4 Services.
Directional whole-Node Grant
Use when an external person truly needs the machine, with the host firewall still final.
Narrower Service Grant
Prefer protocol, host and port scope when the collaborator needs only one service.
Scoped access
Give automation and collaborators exactly one useful path.
Model the destination first, then choose the identity, credential, and compatible Grant that match it.