Aembit User Guide Overview

Welcome to the Aembit User Guide!

Use this guide to help you understand, deploy, and manage Aembit’s Workload Identity and Access Management Platform. This guide contains the following main sections, each focusing on different aspects of Aembit’s functionality and configuration.

The two planes

Aembit divides its work between two planes. Both planes run in . The management plane is where people and automation define the configuration. They write it through the UI of your , the Cloud API, or the Terraform provider. That configuration is the Access Policies, each binding a Client Workload, Trust Provider, Credential Provider, and Server Workload. The control plane authorizes workload access at runtime: it verifies the workload’s identity, evaluates the Access Policy, and brokers the credential. Nobody works in the control plane directly: components and the Edge SDK, Edge API, and Aembit CLI talk to it on a workload’s behalf. No workload gets a credential through the management plane, and no one configures Access Policies through the control plane.

Plane	Who works there	Interfaces	Responsibility
Management plane	Administrators, security engineers, and platform automation	Tenant UI, Cloud API, Terraform provider	Define and maintain the Access Policies and their components, and audit access
Control plane	Workloads, through Aembit Edge components or the runtime paths	Agent Proxy, Edge SDK, Edge API, CLI	Verify identity, evaluate the Access Policy, and broker the credential

For who does what in each plane and how the planes interact at runtime, see Planes and responsibilities.

Deploy and install

This section covers how to deploy Aembit Edge Components in different environments and configurations. It provides detailed instructions for setting up Aembit in different infrastructure contexts.