Transport provider, grant and binding

packs:rpc

Three records carry the governed transport lane for remote-execution steps: a transport provider (how sessions are established — the connection facts and a credential reference, or an inline credential held encrypted at rest; never the credential on a read), a transport grant (who may use which provider against which scope, with caps and a pending→active→revoked lifecycle), and a scope binding (which provider serves which estate subtree; the deepest covering binding wins). Providers and bindings are administered by platform admins; grants follow the approval fabric where it is composed. Served by the v2 TransportProviderService (create/update/test/delete providers, set/delete/resolve bindings) and TransportGrantService (create, approve, revoke, list).

TransportProvider

TransportProvider is one registered transport-provider record. There is no credential field on a read: the record carries credential_ref, a secret-vault:// address (a pointer, not a secret), or holds the inline credential encrypted at rest and reports credential_set.

Field	Type	Meaning
code	string	The estate code the provider is addressed by (bindings and node properties reference it).
config_json	string	Kind-specific connection facts as a JSON object (for ssh-static: username, auth_method, port, connect_timeout_seconds; for ssh-ca: username, principals, validity_seconds, port, connect_timeout_seconds) — never credential material.
created_at	timestamp	When the record was created.
credential_ref	string	The canonical secret-vault:// reference the credential lives at (provider-qualified secret-vault:// @/ included). Empty when the credential is held encrypted at rest on the record (an inline write clears the reference; a reference write clears the at-rest value).
credential_set	boolean	Whether a credential is held — a pinned reference or an inline value encrypted at rest (the value is write-only).
display_name	string	Display name.
enabled	boolean	Whether the record is enabled.
id	string	The record's identity.
kind	string	The provider kind: "ssh-static" or "ssh-ca".
last_test_at	timestamp	The most recent test verb's outcome (never credential material). last_test_at is unset until the first test.
last_test_error	string	The most recent test's failure message; empty when the last test succeeded or none ran.
last_test_success	boolean	Whether the most recent test verb succeeded.
updated_at	timestamp	When the record was last updated.

TransportGrant

TransportGrant is one transport-grant record: subject, provider pattern, scope glob, action patterns, caps, step-up demand and the pending→active→revoked lifecycle columns.

Field	Type	Meaning
actions	array of string	rpc action patterns (exec, put, get, sync, facts, ensure, globs over them); empty grants every action — the default *.
approved_at	timestamp	When the pending grant's approval completed; unset while pending or when it activated directly.
approved_by	string	Who approved the pending grant (the quorum's completing approver); empty when it activated directly.
approvers	array of string	The funnel checklist's approvers as principal ids (required when the approval fabric is composed); a write may supply usernames or <provider>:<username>, resolved and stored as ids.
expires_at	timestamp	The validity window's end; unset grants until revoked.
granted_at	timestamp	When the grant was created.
granted_by	string	Who created the grant.
id	string	The record's identity.
note	string	Why the grant exists — the operator's free-text rationale.
provider	string	The granted transport provider's code, or a code glob (e.g. "nonprod-*").
rate_per_minute	integer	Caps: sessions per minute / per UTC day; 0 is capless. Refusals land warn:transport:cap_refused.
require_step_up	boolean	Session minting demands a stepped-up session from the requesting principal.
revoked_at	timestamp	When the grant was terminally revoked (rejection and quorum-TTL expiry revoke a pending grant too).
revoked_by	string	Who revoked the grant.
scope	string	The node-path glob sessions may target (e.g. "/projects/*/environments/nonprod/**").
sessions_per_day	integer	Session cap per UTC day (the fixed-window pair of rate_per_minute); 0 is capless.
status	string	"pending", "active" or "revoked".
subject_id	string	The subject's identity: for a "user" subject the principal id (a write may supply a username held by exactly one account or <provider>:<username>, resolved and stored as the id — matching is by id, never by username); else a group name, a service-account id, or an agent fleet-group name.
subject_kind	string	The subject kind: "user", "group", "service_account" or "agent_group" (humans and agents gate identically).

TransportProviderBinding

TransportProviderBinding is one declared scope-path → provider mapping, carrying the bound provider's identity and health.

Field	Type	Meaning
created_at	timestamp	When the record was created.
id	string	The record's identity.
provider_code	string	The bound provider's code.
provider_enabled	boolean	The bound provider's enabled state, carried so a listing shows an unhealthy binding at a glance.
provider_id	string	The bound provider's identity.
provider_last_test_at	timestamp	The bound provider's most recent test instant; unset until the first test.
provider_last_test_error	string	The bound provider's most recent test failure message; empty when it succeeded or none ran.
provider_last_test_success	boolean	Whether the bound provider's most recent test succeeded.
scope_path	string	"/" (the estate default), "/projects/ " or "/projects/ /environments/".
updated_at	timestamp	When the record was last updated.

Related pages

• opschain docs transport-providers — the component page: dispatch-time session establishment, binding resolution and the grant funnel.
• opschain docs packs-rpc — the pack whose remote-execution actions ride these sessions.
• opschain docs resources/infrastructure_node — the hosts sessions target.