{
  "schema_version": 1,
  "diagram_type": "sequence",
  "meta": {
    "title": "Service-to-Service (M2M) Authentication",
    "viewBox": [1080, 520],
    "column_fit": "spread",
    "quality_profile": "showcase"
  },
  "participants": [
    { "id": "worker", "type": "backend", "label": "Ingest Worker", "sublabel": "temporal/cron" },
    { "id": "authentik", "type": "security", "label": "Authentik", "sublabel": "OIDC provider" },
    { "id": "memory", "type": "backend", "label": "Memory Service", "sublabel": "poimen-memory" },
    { "id": "jwks", "type": "security", "label": "JWKS", "sublabel": "RS256 keys" }
  ],
  "segments": [
    { "from": 150, "to": 230, "label": "Token Mint" },
    { "from": 240, "to": 380, "label": "API + RBAC" }
  ],
  "messages": [
    { "id": "token-req", "from": "worker", "to": "authentik", "y": 165, "label": "POST /token grant_type=password", "variant": "emphasis", "note": "client_id + username + app_password + scope" },
    { "id": "jwt-resp", "from": "authentik", "to": "worker", "y": 205, "label": "JWT {groups,roles,aud,iss}", "variant": "return", "note": "groups=[poimen-admins] roles=[memory:write]" },
    { "id": "api-call", "from": "worker", "to": "memory", "y": 260, "label": "POST /memory/ingest", "variant": "emphasis", "note": "Authorization: Bearer <JWT>" },
    { "id": "fetch-jwks", "from": "memory", "to": "jwks", "y": 295, "label": "GET /jwks (cached)", "variant": "dashed" },
    { "id": "jwks-resp", "from": "jwks", "to": "memory", "y": 330, "label": "RSA pubkey (kid)", "variant": "return" },
    { "id": "verify-ok", "from": "memory", "to": "worker", "y": 365, "label": "202 Accepted", "variant": "return", "note": "sig ✓ iss ✓ aud ✓ has_capability ✓" }
  ],
  "activations": [
    { "participant": "worker", "from": 160, "to": 371, "type": "backend" },
    { "participant": "authentik", "from": 165, "to": 211, "type": "security" },
    { "participant": "memory", "from": 255, "to": 371, "type": "backend" },
    { "participant": "jwks", "from": 290, "to": 336, "type": "security" }
  ],
  "cards": [
    {
      "dot": "emerald",
      "title": "M2M Pattern",
      "items": [
        "grant_type=password (Authentik aliases client_credentials)",
        "App-password token authenticates the service account",
        "NOT client_secret — that creates nameless SA"
      ]
    },
    {
      "dot": "rose",
      "title": "JWT Claims",
      "items": [
        "groups: from user.groups (poimen-admins)",
        "roles: from user.attributes.roles",
        "iss/aud: per-provider issuer"
      ]
    }
  ]
}