How it works¶
RG Platform is three layers with strictly separated responsibilities: a global cloud control plane for accounts and cluster registry, autonomous regional clusters that execute all device operations, and edge agents and bridges on the devices themselves. Users authenticate to the cloud and exchange that session for short-lived, cluster-scoped credentials; devices authenticate only to their own cluster. The cloud holds no device credentials and sits on no device data path.
The three layers¶
Each layer owns a distinct set of responsibilities and fails independently. The table below states what each layer does and how it behaves when isolated from the others.
| Layer | Responsibilities | Behavior on failure/isolation |
|---|---|---|
| Cloud (global control plane) | Accounts, organization roles, cluster registry, token issuance. Holds no device credentials; sits on no device data path. | If the cloud is unreachable, existing cluster-scoped credentials keep working until expiry; clusters continue running. Only new cross-cluster sign-in and registry changes pause. |
| Cluster (regional execution plane) | Device identity, pairing, reverse channels, configuration, adapters, telemetry, local audit and RBAC. Autonomous. | Operates independently of the cloud. A regional cluster keeps pairing, controlling, and auditing its own fleet with no external connectivity. |
| Device (edge agents & bridges) | The outbound channel, atomic configuration application, signed self-update. | On link loss, reconnects with backoff; applies configuration atomically; pulls control signals when it next reaches its cluster. No inbound path is ever required. |
The cloud control plane¶
The cloud is a thin global layer that manages who exists and which clusters exist, and issues the tokens that let a user reach a cluster. It stores organizations, users, organization-scope roles, and the registry of clusters, and it mints short-lived cluster-scoped credentials on demand. It deliberately holds no device credentials and never sits on a device's data path, so a cloud outage cannot sever a device from its cluster or expose device traffic. This separation is what makes the platform survivable: the layer that could be a global single point of failure is kept off the runtime path entirely.
The cluster execution plane¶
Each RG Cluster is a regional, autonomous execution plane built from interchangeable nodes. It owns everything that actually operates the fleet homed to it: device identity, the pairing flow, the persistent reverse channels, configuration delivery, adapters, telemetry collection, local RBAC evaluation, and a local audit trail. Because all of this is local, a cluster continues to function when the cloud layer is lost — pairing, control, monitoring, and audit keep working. A device belongs to exactly one cluster, authenticates only to that cluster, and its identity is valid nowhere else. This is the layer an air-gapped deployment runs entirely on its own.
The device layer¶
At the edge, an agent (embedded on a device) or a bridge appliance (fronting external devices) maintains a single outbound channel to its cluster node and does three things reliably. It holds the channel open, reconnecting with backoff whenever the link drops, so intermittent networks self-heal. It applies configuration atomically, so a partial or interrupted change never leaves the device in a broken state. And it self-updates from signed artifacts, verifying integrity before applying an upgrade. All cluster-to-device instruction is pull-based: the device polls for configuration, reboot, reprovision, and upgrade signals rather than accepting any inbound connection.
The authentication flow¶
Authentication follows the layer separation exactly. A user signs in to the cloud and receives an organization-scoped session; to act on a specific cluster, that session is exchanged for a short-lived, cluster-scoped credential that is valid only on that cluster and only until it expires. The user's tool then talks directly to the cluster with that credential — the cloud is not in the request path. Devices never touch this flow: a device authenticates solely to its own cluster using a key it generated during pairing, and that identity is meaningless on any other cluster. Machine and API callers follow the same exchange, using credentials whose secrets are revealed once and stored only as irreversible hashes.