{
  "schema_version": 1,
  "diagram_type": "sequence",
  "meta": {
    "title": "Service Acting on Behalf of User",
    "viewBox": [1000, 600],
    "column_fit": "spread",
    "quality_profile": "showcase"
  },
  "participants": [
    { "id": "user", "type": "external", "label": "User", "sublabel": "browser" },
    { "id": "app", "type": "frontend", "label": "Web App", "sublabel": "poimen UI" },
    { "id": "authentik", "type": "security", "label": "Authentik", "sublabel": "OIDC" },
    { "id": "worker", "type": "backend", "label": "Backend Worker", "sublabel": "temporal/queue" },
    { "id": "memory", "type": "backend", "label": "Memory API", "sublabel": "poimen-memory" },
    { "id": "jwks", "type": "security", "label": "JWKS", "sublabel": "RS256" }
  ],
  "segments": [
    { "from": 150, "to": 260, "label": "User Auth" },
    { "from": 270, "to": 370, "label": "Delegation" },
    { "from": 380, "to": 510, "label": "Downstream" }
  ],
  "messages": [
    { "id": "login", "from": "user", "to": "app", "y": 165, "label": "login (OIDC)", "variant": "default" },
    { "id": "oidc-flow", "from": "app", "to": "authentik", "y": 200, "label": "authorization_code flow", "variant": "emphasis" },
    { "id": "user-jwt", "from": "authentik", "to": "app", "y": 235, "label": "user JWT {groups,roles}", "variant": "return" },
    { "id": "trigger-job", "from": "user", "to": "app", "y": 285, "label": "trigger async job", "variant": "default" },
    { "id": "queue-job", "from": "app", "to": "worker", "y": 320, "label": "enqueue job + user JWT", "variant": "emphasis", "note": "JWT passed as job metadata" },
    { "id": "job-ack", "from": "worker", "to": "app", "y": 355, "label": "job queued", "variant": "return" },
    { "id": "call-memory", "from": "worker", "to": "memory", "y": 400, "label": "POST /memory/ingest", "variant": "emphasis", "note": "Bearer <user JWT>" },
    { "id": "fetch-jwks", "from": "memory", "to": "jwks", "y": 435, "label": "GET /jwks", "variant": "dashed" },
    { "id": "jwks-keys", "from": "jwks", "to": "memory", "y": 470, "label": "RSA pubkey", "variant": "return" },
    { "id": "ingest-ok", "from": "memory", "to": "worker", "y": 505, "label": "202 Accepted", "variant": "return", "note": "uses USER's groups/roles" }
  ],
  "activations": [
    { "participant": "user", "from": 160, "to": 291, "type": "external" },
    { "participant": "app", "from": 165, "to": 361, "type": "frontend" },
    { "participant": "authentik", "from": 195, "to": 241, "type": "security" },
    { "participant": "worker", "from": 315, "to": 511, "type": "backend" },
    { "participant": "memory", "from": 395, "to": 511, "type": "backend" },
    { "participant": "jwks", "from": 430, "to": 476, "type": "security" }
  ],
  "cards": [
    {
      "dot": "emerald",
      "title": "Delegation Pattern",
      "items": [
        "User JWT travels with the job payload",
        "Worker uses user's token for downstream",
        "Memory sees USER as the principal"
      ]
    },
    {
      "dot": "rose",
      "title": "Security Model",
      "items": [
        "No service-account escalation",
        "User's permissions bound the action",
        "Audit trail traces to user.sub"
      ]
    }
  ]
}