The modern, unified, open source secure access platform

Signing in once, then reaching Services with and without a client

• A browser opens grafana.acme.com and is redirected to the Cluster sign-in page at acme.com/login.
• jane signs in with a passkey verified by a biometric on the device, and the browser returns to the Grafana dashboard at grafana.acme.com with no client installed.
• In a terminal, octelium connect -d opens the browser at acme.com/callback/success/approval, where the same browser session approves the login with one click.
• ~ ❯ octelium connect -d
• Please authenticate yourself using Octelium web Portal
• Waiting for you to approve the login in your browser. Press Ctrl-C to cancel.
• You are now authenticated as jane
• Octelium has started running in detached mode.
• ~ ❯ curl -s my-api/v1/users/42 | jq
• {
• "id": 42,
• "name": "Jane Doe",
• "email": "jane@acme.com"
• }
• ~ ❯ psql -h pg-prod -d shop
• psql (17.4)
• Type "help" for help.
• shop=> SELECT * FROM orders LIMIT 3;
• id | status | total
• -----+---------+--------
• 981 | paid | 129.00
• 982 | shipped | 48.50
• 983 | paid | 310.25
• (3 rows)
• shop=> \q
• ~ ❯ ssh bastion
• Welcome to Ubuntu 24.04.1 LTS (GNU/Linux 6.8.0-1021-aws x86_64)

Upstream credentials injected per request by identity in the HTTP, SSH and PostgreSQL modes

• HTTP: the HTTP Service stripe proxies https://api.stripe.com and picks the upstream credential of every request with dynamic configuration rules.
• elena, a member of the finance-eu Group, runs curl -s stripe/v1/account | jq '{id, country}' without holding any credential. The rule "finance-eu" in ctx.user.spec.groups selects the eu config, so Octelium injects the Secret stripe-eu and the upstream authenticates the request as acct_1Pq8EuGmbH2bXvK3. The terminal shows { "id": "acct_1Pq8EuGmbH2bXvK3", "country": "DE" }
• pay-agent, a member of the finance-us Group, runs curl -s stripe/v1/account | jq '{id, country}' without holding any credential. The rule "finance-us" in ctx.user.spec.groups selects the us config, so Octelium injects the Secret stripe-us and the upstream authenticates the request as acct_1Nf2UsQ7cLm4RtW9. The terminal shows { "id": "acct_1Nf2UsQ7cLm4RtW9", "country": "US" }
• SSH: the SSH Service web-01 proxies ssh://10.0.4.21 and picks the upstream credential of every request with dynamic configuration rules.
• sam, a member of the sre Group, runs ssh web-01 without holding any credential. The rule "sre" in ctx.user.spec.groups selects the root config, so Octelium injects the Secret root-key and the upstream authenticates the request as root. The terminal shows Welcome to Ubuntu 24.04.3 LTS (GNU/Linux 6.14.0-1015-aws x86_64) root@web-01:~# id uid=0(root) gid=0(root) groups=0(root)
• noah, a member of the developers Group, runs ssh web-01 without holding any credential. The rule "developers" in ctx.user.spec.groups selects the deploy config, so Octelium injects the Secret deploy-key and the upstream authenticates the request as deploy. The terminal shows Welcome to Ubuntu 24.04.3 LTS (GNU/Linux 6.14.0-1015-aws x86_64) deploy@web-01:~$ id uid=1001(deploy) gid=1001(deploy) groups=1001(deploy)
• PostgreSQL: the POSTGRES Service orders-db proxies postgres://10.0.2.8:5432 and picks the upstream credential of every request with dynamic configuration rules.
• priya, a member of the backend Group, runs psql -h orders-db orders without holding any credential. The rule "backend" in ctx.user.spec.groups selects the rw config, so Octelium injects the Secret pg-rw and the upstream authenticates the request as app_rw. The terminal shows psql (17.2) Type "help" for help. orders=> UPDATE orders SET status = 'shipped' WHERE id = 42; UPDATE 1
• bi-agent, a member of the analytics Group, runs psql -h orders-db orders without holding any credential. The rule "analytics" in ctx.user.spec.groups selects the ro config, so Octelium injects the Secret pg-ro and the upstream authenticates the request as app_ro. The terminal shows psql (17.2) Type "help" for help. orders=> UPDATE orders SET status = 'shipped' WHERE id = 42; ERROR: permission denied for table orders

Capabilities of the LLM and MCP gateway modes, each shown as the Service configuration that enables it

• LLM gateway, Prompt instructions: Insert, replace or reject system instructions and messages. openai.yaml reads as follows.
• kind: Service
• metadata:
• name: openai
• spec:
• mode: LLM
• config:
• upstream:
• url: https://api.openai.com
• llm:
• protocol: OPENAI
• auth:
• bearer:
• fromSecret: openai-api-key
• plugins:
• - name: house-rules
• condition:
• match: ctx.request.llm.operation == "GENERATE"
• prompt:
• system:
• mode: PREPEND
• content:
• value: Follow Acme's security and data-handling rules.
• - name: caller-identity
• condition:
• match: ctx.request.llm.operation == "GENERATE"
• prompt:
• message:
• role: USER
• position: NEW_BEFORE
• content:
• eval: '"The requesting User is " + ctx.user.metadata.name'
• mode: PREPEND: first instruction
• eval: '"The requesting User is " + ctx.user.metadata.name': …User is support-bot
• LLM gateway, Guardrails: Deny secrets and redact personal data before the model sees it. openai.yaml reads as follows.
• kind: Service
• metadata:
• name: openai
• spec:
• mode: LLM
• config:
• upstream:
• url: https://api.openai.com
• llm:
• protocol: OPENAI
• auth:
• bearer:
• fromSecret: openai-api-key
• plugins:
• - name: input-dlp
• condition:
• match: ctx.request.llm.operation == "GENERATE"
• guardrail:
• leg: REQUEST
• scopes:
• - CONTENT
• - TOOL_RESULTS
• patterns:
• - secrets: {}
• action: DENY
• - type: EMAIL
• action: REDACT
• denyMessage: The request contains restricted content
• action: DENY: sk-proj-… → 403
• action: REDACT: jane@acme.com → [REDACTED:EMAIL]
• LLM gateway, Model and reasoning: Decide the model and how much it may reason, per identity. openai.yaml reads as follows.
• kind: Service
• metadata:
• name: openai
• spec:
• mode: LLM
• config:
• upstream:
• url: https://api.openai.com
• llm:
• protocol: OPENAI
• model:
• eval: '"ai-admins" in ctx.user.spec.groups ? "gpt-5" : "gpt-5-mini"'
• reasoning:
• level: MEDIUM
• auth:
• bearer:
• fromSecret: openai-api-key
• eval: '"ai-admins" in ctx.user.spec.groups ? "gpt-5" : "gpt-5-mini"': support-bot → gpt-5-mini
• level: MEDIUM: reasoning_effort: medium
• LLM gateway, Semantic routing and caching: Route by meaning and answer repeats from a per-User cache. openai.yaml reads as follows.
• kind: Service
• metadata:
• name: openai
• spec:
• mode: LLM
• config:
• upstream:
• url: https://api.openai.com
• llm:
• protocol: OPENAI
• auth:
• bearer:
• fromSecret: openai-api-key
• embedding:
• source:
• currentUpstream: true
• model: text-embedding-3-small
• plugins:
• - name: auto-model
• condition:
• match: ctx.request.llm.model == "auto"
• semanticRouter:
• fallbackModel: gpt-5-mini
• routes:
• - name: engineering
• examples:
• - Why is this Go program deadlocking?
• model: gpt-5
• - name: user-cache
• condition:
• match: ctx.request.llm.operation == "GENERATE"
• semanticCache:
• scope:
• perUser: true
• minSimilarity: 0.92
• useXCacheHeader: true
• - name: engineering: similarity 0.81
• model: gpt-5: auto → gpt-5
• minSimilarity: 0.92: 0.97
• useXCacheHeader: true: X-Cache: HIT
• LLM gateway, Token rate limiting: Sliding-window token budgets per User, Session or tenant. openai.yaml reads as follows.
• kind: Service
• metadata:
• name: openai
• spec:
• mode: LLM
• config:
• upstream:
• url: https://api.openai.com
• llm:
• protocol: OPENAI
• auth:
• bearer:
• fromSecret: openai-api-key
• plugins:
• - name: user-budget
• condition:
• match: ctx.request.llm.operation == "GENERATE"
• tokenRateLimit:
• key:
• perUser: true
• limit: 100000
• window:
• hours: 1
• defaultOutputTokens: 2048
• denyMessage: The hourly token budget has been exhausted
• limit: 100000: 98,912 used
• defaultOutputTokens: 2048: 2,048 reserved
• denyMessage: The hourly token budget has been exhausted: 429 Too Many Requests
• LLM gateway, Protocol translation: Serve the OpenAI API to agents from an Anthropic upstream. claude.yaml reads as follows.
• kind: Service
• metadata:
• name: claude
• spec:
• mode: LLM
• config:
• upstream:
• url: https://api.anthropic.com
• llm:
• protocol: OPENAI
• translation:
• upstreamProtocol: ANTHROPIC
• defaultMaxOutputTokens: 4096
• auth:
• custom:
• header: x-api-key
• value:
• fromSecret: anthropic-api-key
• protocol: OPENAI: /v1/chat/completions
• upstreamProtocol: ANTHROPIC: /v1/messages
• fromSecret: anthropic-api-key: injected upstream
• MCP gateway, Tool-level access control: Authorize every method, tool and argument per identity. finance-mcp.yaml reads as follows.
• kind: Service
• metadata:
• name: finance-mcp
• spec:
• mode: MCP
• config:
• upstream:
• url: http://10.0.5.18:8080/mcp
• mcp:
• endpoint: /mcp
• auth:
• bearer:
• fromSecret: mcp-upstream-token
• authorization:
• inlinePolicies:
• - spec:
• rules:
• - effect: ALLOW
• condition:
• match: ctx.request.mcp.method == "tools/list"
• - effect: ALLOW
• condition:
• all:
• of:
• - match: ctx.request.mcp.method == "tools/call"
• - match: ctx.request.mcp.name == "transfer"
• - match: '"finance-agents" in ctx.user.spec.groups'
• - match: ctx.request.mcp.http.bodyMap.params.arguments.amount <= 1000
• match: ctx.request.mcp.method == "tools/list": tools/list
• - match: ctx.request.mcp.method == "tools/call": tools/call
• - match: ctx.request.mcp.name == "transfer": transfer
• - match: '"finance-agents" in ctx.user.spec.groups': finance-agents
• - match: ctx.request.mcp.http.bodyMap.params.arguments.amount <= 1000: 25000
• MCP gateway, Guardrails: Catch leaked secrets in arguments and injections in results. finance-mcp.yaml reads as follows.
• kind: Service
• metadata:
• name: finance-mcp
• spec:
• mode: MCP
• config:
• upstream:
• url: http://10.0.5.18:8080/mcp
• mcp:
• endpoint: /mcp
• auth:
• bearer:
• fromSecret: mcp-upstream-token
• plugins:
• - name: tool-content
• condition:
• match: ctx.request.mcp.method == "tools/call"
• guardrail:
• leg: BOTH
• scopes:
• - TOOL_ARGUMENTS
• - TOOL_RESULTS
• patterns:
• - secrets: {}
• action: DENY
• - regex: '(?i)ignore (all )?previous instructions'
• action: DENY
• denyMessage: Restricted content was detected
• - TOOL_ARGUMENTS: agent → server
• - TOOL_RESULTS: server → agent
• action: DENY: ghp_… in arguments
• action: DENY: injection in a result
• MCP gateway, Lua scripting: Rewrite JSON-RPC messages with the caller's identity. finance-mcp.yaml reads as follows.
• kind: Service
• metadata:
• name: finance-mcp
• spec:
• mode: MCP
• config:
• upstream:
• url: http://10.0.5.18:8080/mcp
• mcp:
• endpoint: /mcp
• auth:
• bearer:
• fromSecret: mcp-upstream-token
• plugins:
• - name: add-user
• condition:
• all:
• of:
• - match: ctx.request.mcp.method == "tools/call"
• - match: ctx.request.mcp.name == "lookup"
• lua:
• inline: |
• function onRequest(ctx)
• local body = json.decode(octelium.req.getRequestBody())
• body.params.arguments.userUID = ctx.user.metadata.uid
• octelium.req.setRequestBody(json.encode(body))
• end
• body.params.arguments.userUID = ctx.user.metadata.uid: 5f0e8b2a-…
• octelium.req.setRequestBody(json.encode(body)): re-validated
• MCP gateway, Rate limiting: Bound tool calls per User and answer with JSON-RPC errors. finance-mcp.yaml reads as follows.
• kind: Service
• metadata:
• name: finance-mcp
• spec:
• mode: MCP
• config:
• upstream:
• url: http://10.0.5.18:8080/mcp
• mcp:
• endpoint: /mcp
• auth:
• bearer:
• fromSecret: mcp-upstream-token
• plugins:
• - name: user-rate
• condition:
• matchAny: true
• rateLimit:
• key:
• perUser: true
• limit: 100
• window:
• minutes: 2
• statusCode: 429
• body:
• inline: '{"jsonrpc":"2.0","error":{"code":-32000,"message":"Rate limit exceeded"},"id":null}'
• limit: 100: 100 used
• statusCode: 429: 101st call
• MCP gateway, Managed containers: Deploy and scale the MCP server itself inside the Cluster. finance-mcp.yaml reads as follows.
• kind: Service
• metadata:
• name: finance-mcp
• spec:
• mode: MCP
• config:
• upstream:
• container:
• image: ghcr.io/acme/finance-mcp:1.4.0
• port: 8080
• replicas: 3
• resourceLimit:
• cpu:
• millicores: 1000
• memory:
• megabytes: 2000
• mcp:
• endpoint: /mcp
• replicas: 3: 3/3 ready

Cluster resources applied declaratively from YAML with octeliumctl and managed programmatically with the Go, TypeScript, Python and Rust SDKs

• GitOps: cluster.yaml in the main branch of the ~/octelium repository describes the desired state of the Cluster. Its diff reads as follows, with + for added, ~ for changed and - for removed lines.
• + kind: Group
• + metadata:
• + name: payments
• + spec: {}
• + ---
• + kind: User
• + metadata:
• + name: alice
• + spec:
• + type: HUMAN
• + email: alice@acme.com
• + groups: ["payments"]
• ---
• kind: User
• metadata:
• name: bob
• spec:
• type: HUMAN
• ~ groups: ["payments"]
• ---
• kind: Service
• metadata:
• name: billing
• spec:
• mode: HTTP
• config:
• upstream:
• ~ url: http://10.0.3.24:8080
• - ---
• - kind: Service
• - metadata:
• - name: billing-legacy
• - spec: ⋯
• - ---
• - kind: User
• - metadata:
• - name: john
• - spec: ⋯
• ~/octelium ❯ octeliumctl apply --prune .
• Group: payments Created
• User: alice Created
• User: bob Updated
• Service: billing.default Updated
• Service: billing-legacy.default Deleted
• User: john Deleted
• Cluster Core resources successfully applied
• 2 resources created
• 2 resources updated
• 2 resources deleted
• Go: main.go uses the octelium-go SDK to list the Users of the Cluster and update the email and Policies of linus.
• client, err := octelium.New(ctx)
• if err != nil {⋯}
• conn, err := client.Conn(ctx)
• if err != nil {⋯}
• api := corev1.NewMainServiceClient(conn)
• users, err := api.ListUser(ctx, &corev1.ListUserOptions{})
• if err != nil {⋯}
• for _, u := range users.Items {
• fmt.Println(u.Metadata.Name)
• }
• user, err := api.GetUser(ctx, &metav1.GetOptions{Name: "linus"})
• if err != nil {⋯}
• user.Spec.Email = "linus@acme.com"
• user.Spec.Authorization = &corev1.User_Spec_Authorization{
• Policies: []string{"db-readonly"},
• }
• if _, err := api.UpdateUser(ctx, user); err != nil {⋯}
• fmt.Println("updated", user.Metadata.Name)
• ~/app ❯ go run .
• alice
• bob
• linus
• updated linus
• TypeScript: main.ts uses the @octelium/sdk SDK to list the Users of the Cluster and update the email and Policies of linus.
• const client = await OcteliumClient.create({
• domain: "acme.com",
• auth: {⋯},
• });
• const users = await client.coreV1.listUser(ListUserOptions.create());
• for (const u of users.response.items) {
• console.log(u.metadata?.name);
• }
• const { response: user } = await client.coreV1.getUser(
• GetOptions.create({ name: "linus" }),
• );
• user.spec!.email = "linus@acme.com";
• user.spec!.authorization = User_Spec_Authorization.create({
• policies: ["db-readonly"],
• });
• await client.coreV1.updateUser(user);
• console.log("updated", user.metadata?.name);
• await client.close();
• ~/app ❯ npx tsx main.ts
• alice
• bob
• linus
• updated linus
• Python: main.py uses the octelium-sdk SDK to list the Users of the Cluster and update the email and Policies of linus.
• async with await OcteliumClient.create() as client:
• users = await client.core_v1.list_user(ListUserOptions())
• for u in users.items:
• print(u.metadata.name)
• user = await client.core_v1.get_user(GetOptions(name="linus"))
• user.spec.email = "linus@acme.com"
• user.spec.authorization.policies = ["db-readonly"]
• await client.core_v1.update_user(user)
• print("updated", user.metadata.name)
• ~/app ❯ python main.py
• alice
• bob
• linus
• updated linus
• Rust: main.rs uses the octelium SDK to list the Users of the Cluster and update the email and Policies of linus.
• let client = Client::from_env().await?;
• let mut api = client.core_v1();
• let users = api.list_user(ListUserOptions::default()).await?;
• for u in users.into_inner().items {
• println!("{}", u.metadata.unwrap_or_default().name);
• }
• let options = GetOptions {
• name: "linus".into(),
• ..Default::default()
• };
• let mut user = api.get_user(options).await?.into_inner();
• let spec = user.spec.get_or_insert_default();
• spec.email = "linus@acme.com".into();
• spec.authorization.get_or_insert_default().policies = vec!["db-readonly".into()];
• let user = api.update_user(user).await?.into_inner();
• println!("updated {}", user.metadata.unwrap_or_default().name);
• ~/app ❯ cargo run -q
• alice
• bob
• linus
• updated linus