Technical Architecture
The Own360 Ecosystem.
Three-layer architecture.
WebAuthn passkeys
SAML 2.0 SSO
Cascading perms
Agent scopes
Human-in-loop
Cross-app triggers
Auth enforcement
Request transform
Event sourcing
Tamper detection
Anomaly detection
Real-time dashboards
Control plane architecture.
Identity & Authentication
Multi-tenant identity provider with per-tenant branding. Supports federated SSO via SAML 2.0 and OIDC, plus native authentication with WebAuthn passkey support.
POST /central/v1/auth/agent-token
Content-Type: application/json
{
"agent_id": "deal-agent-01",
"scopes": ["crm:read", "crm:write",
"finance:read"],
"context": {
"workflow_id": "wf-pipeline-review",
"initiated_by": "user:sarah@acme.com"
},
"ttl": 3600
}
// Response
{
"token": "eyJhbG...",
"scopes_granted": ["crm:read", "crm:write",
"finance:read"],
"audit_id": "aud-7f3a9b2c",
"expires_at": "2026-03-29T15:00:00Z"
}Permission Model
Attribute-based access control (ABAC) layered on top of RBAC. Policies cascade from organization → department → team → user → agent. Agent permissions are a strict subset of the initiating user's permissions.
// OwnCentral policy DSL
policy "deal-agent-crm-access" {
subjects = ["agent:deal-agent-*"]
resources = ["crm:deals", "crm:contacts",
"finance:invoices"]
actions = ["read", "update", "create"]
conditions = {
time_window = "business_hours"
requires_human_approval = ["create"]
max_records_per_hour = 500
}
audit_level = "full"
}Workflow Engine
DAG-based workflow execution engine written in Rust. Supports 13 node types including human-in-the-loop approval, conditional branching, parallel execution, and cross-application triggers. Workflows are versioned, auditable, and resumable after failure.
Audit Log Architecture
Event-sourced, append-only log with cryptographic integrity verification. Every action by every user and every agent produces an immutable audit event. Hash-chain linking provides tamper detection equivalent to blockchain verification without the overhead.
{
"event_id": "evt-9f2a7b3c",
"timestamp": "2026-03-29T14:23:17Z",
"actor": {
"type": "agent",
"id": "deal-agent-01",
"initiated_by": "user:sarah@acme.com"
},
"action": "crm.deal.stage_advance",
"resource": "deal:d-4521",
"context": {
"workflow_id": "wf-pipeline-review",
"previous_stage": "qualification",
"new_stage": "negotiation"
},
"hash": "a7f3...b92c",
"prev_hash": "e1d4...f8a1"
}How data moves through the system.
Event Bus Architecture
OwnAgents execution model.
OwnAgents is not an LLM wrapper. It is a governed execution runtime that orchestrates AI capabilities within the permission and audit boundaries defined by OwnCentral. Every agent action is: authorized before execution, logged during execution, and auditable after execution.
Event, schedule, or user request initiates agent task
OwnCentral evaluates permissions, issues scoped token
Org context injected — relevant data from connected modules
Agent reasons, plans actions, requests approval if required
Approved actions execute against target modules via API gateway
Every action logged with full context chain — who, what, why, when
APIs, webhooks, and extension points.
REST API
Every OwnApps module exposes a versioned REST API. OpenAPI 3.1 specs auto-generated. All requests route through OwnCentral for auth and audit.
GraphQL
Unified GraphQL endpoint for cross-module queries. Schema stitching across OwnApps modules. Field-level permission enforcement.
Webhooks
Configurable outbound webhooks for every event type. Exponential backoff retry. HMAC-SHA256 signature verification on every payload.
Event Streams
Real-time event subscription via SSE or WebSocket. Consumer groups for distributed processing. Exactly-once semantics with idempotency.
SDK
First-party SDKs for Node.js, Python, Go, and Java. Handles authentication, pagination, error handling, and type safety.
Custom Modules
Build your own modules on the OwnCentral runtime. Full access to identity, permissions, workflow, and audit infrastructure. Deploy as containers.
Defense in depth.
Network
Private VPC deployment. No public endpoints except API gateway. mTLS between all internal services. Network policies enforce service-to-service communication rules.
Transport
TLS 1.3 for all external connections. mTLS for internal service mesh. Certificate rotation every 24 hours via internal CA. Perfect forward secrecy enforced.
Application
OWASP Top 10 hardened. Input validation at every boundary. SQL injection prevention via parameterized queries. XSS prevention via CSP headers. CSRF tokens on every mutation.
Data
AES-256-GCM encryption at rest. Argon2id key derivation. Per-tenant encryption keys. Row-level security in PostgreSQL. Encrypted backups with separate key hierarchy.
Identity
Zero-trust authentication. Every request re-evaluated. No implicit trust between services. Agent permissions are a strict subset of the initiating user. Session binding to device fingerprint.
Audit
Every action logged immutably. Hash-chain integrity. Tamper detection alerts. Real-time anomaly detection on access patterns. Compliance-ready exports for SOC 2, ISO 27001 (certifications in process).
Your infrastructure. Our software.
On-Premise
Bare metal or VMware. Kubernetes via k3s or upstream. Air-gapped deployment supported. No outbound internet required post-installation.
Private Cloud
Deploy in your own AWS, GCP, or Azure account. Terraform modules provided. We manage, you own the infrastructure and the data.
Managed
Own360-managed deployment on dedicated infrastructure. 99.9% SLA. 24/7 monitoring. Automated backups, patching, and scaling. You own the licence, we run it.
What it's built with.
Want the full technical deep-dive?
Architecture review. Live system walkthrough. Your infrastructure requirements discussed.
Schedule a technical session →