ContextWeaver | Identity & Authentication Security →
🔐

Three Identity Planes, One Platform

Customer Entra (infrastructure) · Provider Entra (platform ops) · Magic Link (end users) — unified into a single session model

🏛️ CUSTOMER ENTRA ID Customer's Azure AD tenant • Owns Azure subscription • Creates Managed Identity • Provisions AKS, Cosmos, OpenAI • Runs Terraform ⚡ May or may not use the AI services Example: IT dept at Acme Corp 🔧 PROVIDER ENTRA ID BrainzBytes / MSP tenant • Platform engineers (ajay@, sre@) • Deploy & manage ContextWeaver • Admin dashboard access • Visual Designer, Monitoring, Cluster 🛡️ Role: manager (full admin) SSO via Microsoft · MFA enforced ✉️ MAGIC LINK USERS End users — any email address • Self-register on login page • Admin approves (one-time) • Passwordless login via email link • Chat, tools, personal credentials 👤 Role: viewer / developer Gmail, Outlook, corporate — any email Terraform / kubectl 🌐 Login Page — app.brainzbytes.com 🔐 Microsoft SSO ✉️ Magic Link 📝 Register session["user"] 🧠 CONTEXTWEAVER PLATFORM All auth paths produce identical session — same RBAC, vault, RAG for everyone 🔀 Auth Router Entra / Magic / SSO 👤 Session Mgr email · roles · groups 🛡️ RBAC viewer→dev→sqa→mgr 🔒 Vault Cascade org→group→user 🧶 RAG Isolation scoped indexes ☁️ Azure Infrastructure AKS · Cosmos · OpenAI · Key Vault · ACS Managed Identity · RBAC · Terraform WHAT EACH IDENTITY ACCESSES 🏛️ Customer IT May not log into the app at all • Azure Portal access • Terraform state • Cost management & billing • Network & security policies 🔧 Provider Admin Full platform management • Admin Dashboard • Visual Designer + Plugin Builder • Cluster View + Monitoring • User approval + Site Admin ✉️ End Users AI-powered chat interface • Chat with AI assistant • MCP tools across connectors • Personal credentials & prefs • Create & manage groups 👥 Groups (Self-Service) Team/family/plan isolation • Create group (become admin) • Invite by email (ACS) • Shared connectors & policies • Isolated from other groups

Plane 1: Customer Entra ID

The customer's Azure AD tenant that owns the cloud infrastructure. This is the billing owner and infrastructure manager.

What they control:
  • Azure subscription & resource group
  • Managed Identity (aiopm-mi) + role assignments
  • Terraform state — provisions AKS, Cosmos, OpenAI, Key Vault, ACR, ACS
  • Network security groups, firewall rules, DNS
  • Cost management and billing
Key point:

These users may never log into the app. They manage infrastructure via Azure Portal, Terraform, and kubectl. They don't use the AI chat or MCP tools — they just make sure the platform runs.

Example: Acme Corp's IT department provisions the Azure resources. They don't use ContextWeaver's AI features — that's for the business users.

Plane 2: Provider Entra ID (BrainzBytes)

The service provider's Azure AD tenant. Platform engineers who deploy, manage, and maintain ContextWeaver.

What they do:
  • Log in via Microsoft SSO (Entra OIDC)
  • Access full Admin Dashboard — all tabs
  • Design plugins in Visual Designer
  • Monitor with Grafana/Prometheus
  • Approve user registrations in Site tab
  • Manage MCP engines, connectors, indexes
Auth flow:
1
Click "Sign in with Microsoft" on login page
2
Redirect to Microsoft Entra OIDC login
3
MFA challenge (if configured by tenant admin)
4
Callback → session created with roles: ["manager"]

Plane 3: Magic Link Users (End Users)

External users who register with any email address. Passwordless authentication via email magic links.

Registration flow:
1
Click "Request Access" → fill Name, Email, Company
2
Account created (status: pending)
3
Provider admin notified → approves in Site tab
4
Welcome email sent with login link → status: active
Login flow (after approval):
1
Enter email → click "Send Magic Link"
2
15-min JWT token sent to email via ACS
3
Click link → token validated → session created
4
Lands in User View with roles: ["developer"]

No passwords. Email IS the identity. Like Slack, Notion, and Vercel.

Unified Session — The Glue

All three identity planes produce the exact same session format. The platform doesn't care how you authenticated.

session["user"] = {
  "email": "sarah@acme.com",
  "displayName": "Sarah Chen",
  "roles": ["developer"],   // viewer | developer | sqa | manager
  "groups": ["acme-corp"],  // from Entra AD or Cosmos
  "source": "magic_link",   // or "entra"
  "authenticated": true
}

Downstream systems (RBAC, Vault Cascade, RAG Isolation, MCP Tools) all read from this session. They never check how you logged in — only your email, roles, and groups.

Identity Plane Comparison

🏛️ Customer Entra🔧 Provider Entra✉️ Magic Link
PurposeInfrastructure ownershipPlatform managementUse AI services
Auth methodAzure Portal / CLIMicrosoft SSO (OIDC)Email magic link (JWT)
Logs into app?OptionalYes — Admin ViewYes — User View
App roleN/A (infra only)managerviewer / developer
Groups sourceN/AAzure AD groupsCosmos DB (admin-assigned or self-service)
CredentialsManaged IdentityEntra token + vaultPersonal vault (per-user)
MFAAzure AD Conditional AccessEntra MFAEmail = 2FA (you must own the inbox)
RegistrationAzure subscriptionAdded to Entra tenantSelf-service → admin approval
Example usersIT admin at Acmeajay@brainzbytessarah@gmail.com
Back to About Security Details Azure Architecture