Enterprise
One CORE contract. Deploy it anywhere.
Managed by 2finity, private, isolated for enterprises or on your own hardware: the capability contract stays the same. Direction, not a product you can order today.
Deployment
Four deployment modes
Managed, private, enterprise isolated and on-premise differ in who runs the infrastructure, how tenants are separated and which identity provider is used. They do not differ in the contract: the same CoreClient, the same capabilities, the same events.
Deployment modes, each a direction rather than a product you can order today:
- Managed by 2finity (Direction): CORE operated by 2finity, one organization per tenant. Isolation: Logical, per organization. Identity: 2finity Identity.
- Private deployment (Direction): A dedicated CORE for one organization on infrastructure 2finity runs for it. Isolation: Dedicated instance. Identity: 2finity Identity or your OIDC provider.
- Enterprise isolated (Direction): Dedicated network, storage and keys; your identity provider; your audit export. Isolation: Network and data. Identity: Your OIDC provider.
- On-premise (Direction): CORE in your own data center. Same contract; you operate it. Isolation: Physical. Identity: Your OIDC provider.
Every mode runs the same CoreClient contract: identity, entities, capabilities, permissions and events.
Isolation
Isolation and data ownership
The organization is the unit of ownership. Entities, permissions and events belong to one organization, and no capability reads across that boundary without a relationship that grants it. Organizations never share a database by accident, because sharing is a relationship, not a join.
Everything an organization owns can leave with it: ledger.export and audit.list exist so that finance records and the full event history are yours to take.
One capability, invoice.create, is built once and runs separately in the CORE of each organization: Organization A, Organization B and Organization C. Each organization keeps its own data and permissions; nothing is shared between them.
Identity
Your identity provider
Isolated and on-premise deployments authenticate against your OpenID Connect provider. CORE resolves identities through one interface, so the provider is configuration, not a fork. 2finity Identity is the planned default for managed and private deployments.
Control
Audit and control
Every capability invocation leaves an event with actor, capability, resource and outcome. Privileged capabilities require a role or an approval, agents act within policy, and the event log is queryable through the same permission checks as the rest of CORE.
Status
Where this stands
The deployment modes describe a direction. What is fixed today is the contract: the ten layers, the capability model and the identity, permission and event mechanics are implemented on this site and tested. Follow the work on 2finity.dev and GitHub.