FAQ

FAQ

For everyone

What is IGL in one sentence? A way to run AI and automated work so that every action states who is acting, what they are allowed to do and why before it runs, and leaves a record afterwards that cannot be quietly changed.

Is it a product or a project? Both. The runtime and the API contract are open source under Apache 2.0. The hosted platform at id-me.ai runs the same contract as a service, with a free self-serve sandbox and production tenants issued by SMEPro Technologies.

Do I need to learn a programming language to use it? No. Most people use the hosted API from their existing applications, or connect an AI assistant to it through MCP. The language exists for people who want governance inside their own programs; the platform applies the same rules to identity data over HTTP.

Which AI models does it work with? Any. IGL governs what a model is allowed to see and do; it does not replace the model. The hosted platform's four intelligence operations use Anthropic's Claude by default, and the contract does not depend on the provider. The runtime examples run a small open model locally.

Is my data used to train anything? No. The platform stores your tenant's records in its own database, serves projections under your purposes, and sends only the admitted records to the reasoning model for the intelligence operations, with the answer and its citations hashed into the receipt.

What does it cost? The sandbox is free and self-serve. Production tenants are issued through Contact Sales on id-me.ai. The runtime is free.

Is this finished? The platform contract is version 0.3 and the runtime is at 1.6.0. The security review is published with all nine of its findings closed and a regression test for each; it was our own review, and an independent one has not happened yet, which the README says plainly. Everything on this wiki describes what exists and runs today; the Roadmap page says what is planned.

For developers

How do I get a key? POST https://sandbox.id-me.ai/sandbox/signup with an organization name and an email. The response is your tenant, your identity and your key, shown once. Quickstart: the API.

Why do I have to send the tenant id if the key already identifies me? So that a key can never be used against the wrong tenant by accident or by trickery. A missing header is a 400 tenant_required; a key that does not belong to the named tenant is a 403 tenant_mismatch, and no operation runs.

Why did my projection come back empty? Read emptyWarning. Either no consent record covers the purpose you asked for, or no node passed the gates. Then call the explain endpoint, which lists every node considered and the first gate it failed.

Why did POST /query return 422? Three reasons, each with a code: no_reasoning_provider (the environment has no model key), empty_context (your explicit scope resolved to no records), or uncited_answer (the model could not support its answer with records in the context). The service refuses rather than guess.

Can I run the platform myself? Yes. platform/api is a Cloudflare Worker with a D1 database; wrangler.toml and the deploy workflow are in the repository, and the conformance suite runs against a local build with npm test inside platform/api. Point the site's developer console at your own host with the self-hosted option.

How do I verify a receipt? Fifteen lines of Node.js with no dependencies, in Quickstart: the API. The public key is at auth.id-me.ai/.well-known/jwks.json.

Does idempotency work across retries? Yes. Send Idempotency-Key on any mutation; the same key with the same body replays the stored response with idempotent-replayed: true; the same key with a different body is a 409.

What is the difference between the runtime's MCP server and the hosted one? The local one (npm run provision) serves your own identity graphs on your machine with seven retrieval and provisioning tools. The hosted one (POST /v1/mcp) serves the platform's seven governance tools over the same handlers as REST. MCP Integration has both configurations.

How do I revoke a key? POST /admin/keys/revoke with the key's clientId, using your tenant's admin key or the platform key. It is refused on the next request. If a key was ever pasted somewhere it should not have been, revoke first.

For security and compliance

Can an operator with database access edit the audit log? Not quietly. The table's triggers refuse updates and deletes, every entry's hash includes the previous entry's hash, and GET /audit/events returns the hashes so you can re-verify from outside.

Who holds the signing key? The service, as a Worker secret or a key generated once and kept in the database. The public half is published. A customer who wants to verify receipts needs only the public key.

What happens when consent is revoked? The next projection under that purpose fails the consent gate for that identity: the nodes are counted in withheld, emptyWarning names the missing consent when nothing passes, the explain endpoint shows the gate, and the revocation itself is an audit event with the actor who did it.

Is there data residency control? Per tenant, a transfer policy says which sensitivities may be served to callers in which countries. Callers in the tenant's home jurisdiction are unaffected; callers elsewhere get public and internal nodes only unless the policy allows more. This is the fourth gate.

Where are the known weaknesses written down? docs/audit/SECURITY-AUDIT-2026-10.md, with probe scripts. The Security Model page summarizes it.

How do I report a vulnerability? Privately, through GitHub's vulnerability reporting on the repository or security@id-me.ai. Acknowledgment within 48 hours.