A reference architecture you can explain

One question.
Five components.
Ask what crosses each boundary.

Follow an AI assistant from browser login to an authorized tool call, and see which service makes each decision along the way.

Start learning →Explore the architecture

15 lessons · 18 Mermaid diagrams · 6 tabletop labs

Required architecture

Inference and MCP both go through AI Gateway.

The harness sends inference to the gateway’s model listener and MCP to its proxy listener, with a separate credential for each. The gateway proxies the upstream server and holds that server’s OAuth tokens, so the harness never handles them. CAS and the organizational identity provider handle the gateway-facing user login. mcp server 1 computes each utility result on its own host without calling a management API. Package and token-lifecycle evidence is tracked separately in the evidence lesson.

Harness

Runs the conversation and the built-in Codex MCP client in one executable, with separate inference and MCP credentials in the native store.

Keycloak

Authenticates the person, then issues the inference token and, separately, the gateway’s upstream MCP token.

AI Gateway

Receives both inference and MCP traffic, applies policy, and manages the upstream connection and its OAuth.

Cloud Identity Engine

Connects directory provisioning and federated authentication to consuming services.

mcp server 1

Authorizes eight utility tools and executes them locally on the server, without downstream API calls.

Try the permission model

A valid login is not the whole grant.

Uncheck one condition and watch the decision change. mcp server 1 requires every one of these to agree before it validates arguments and computes. This local simulation uses fictional values and makes no request.

Read the full authorization contract →

Can Alex call calculate on mcp server 1?Valid token for this resourceResource invoke roleIssued utilities.use scopeMatching utilities.use resource roleSubject policy permits utilities.use

Allowed

All conditions agree. mcp server 1 may validate the arguments and calculate locally.

Illustrative decision only. No login, token, or API request is made.

Choose a route

Follow the arrows.
Then test your explanation.

Sign in and connect ServiceNowCreate an environment, use company SSO, and verify incident tools →Follow one question end to endModel selection, local utility results, and a grounded answer →Practice with answer keysAudience errors, identity joins, refresh races, and revocation →

Know what the evidence supports.

The course distinguishes source implementation, observed deployment, and acceptance of the exact installed release.

Read the status and sources →