Skip to content
Riptides Docs

Identities

The Identities screen lists your workload identities and is where you create, edit, and delete them. A workload identity is how Riptides recognizes a workload, whether a service or an AI agent, and gives it a cryptographic identity it uses for mTLS, access control, and traffic inspection.

Open it from Configure → Identities in the sidebar (/ui/workload-identities).

For an AI agent, creating an identity with traffic inspection turned on is the one prerequisite for the Agentic AI features: once the agent has an identity, its LLM calls and tool use appear in the Activity Monitor and can be governed in Access Control.

What you see

Section titled “What you see”

Each identity appears as a row with its workload ID. Clicking a row opens its detail (selectors, scope, access policy, connection settings, and any egress or ingress rules), and each row’s ⋯ menu offers Edit and Delete. Use Create Identity (top right) to add one.

Create an identity

Section titled “Create an identity”

Choose Create Identity to open the Create Workload Identity dialog. It has two fields at the top and then a set of tabs.

  • Workload ID (required): a short identifier for the workload, such as claude for an agent or payments-api for a service (or something structured like my-org/agents/claude). As you type, the dialog shows the full identity it will create (spiffe://your-trust-domain/claude).
  • Name (optional): leave it blank and Riptides generates one from the Workload ID.

Then work through the tabs:

Selectors (required)

Section titled “Selectors (required)”

Tell Riptides which process this identity applies to. Add a selector such as key process:name, value claude. Suggestion chips offer common keys (process:name, k8s:pod:namespace, docker:name, and more). You can add several values, and add more than one selector group to match “this or that.”

Scope (required)

Section titled “Scope (required)”

Choose where the identity applies: a single Daemon or a Daemon Group, then pick the specific one. Riptides only matches the workload on hosts within this scope.

Connection Properties

Section titled “Connection Properties”

Control how connections are secured. The default TLS mode of Permissive suits most workloads.

For an AI agent, make sure TLS intercept is on (it is on by default). This is the setting that lets Riptides decrypt and inspect the agent’s HTTP and HTTPS calls, which is what makes them appear in the Activity Monitor and become governable. There is no separate “evaluate traffic” switch: standard web traffic is inspected automatically once interception is on.

Access Policy, Egress, Ingress (optional)

Section titled “Access Policy, Egress, Ingress (optional)”

Most workloads need only the tabs above. Access Policy limits which identities may connect to or from this workload (see Access Control). Egress and Ingress override connection behavior per destination or per port.

Choose Create when done. The workload appears in the Identities list.

Edit or delete

Section titled “Edit or delete”

Use the ⋯ menu on a row: Edit reopens the same form (the Workload ID is fixed once created), and Delete asks you to type the name to confirm.

Manage as code (optional)

Section titled “Manage as code (optional)”

If you prefer GitOps, the same identity can be applied as a WorkloadIdentity resource. For an agent, the key field is connection.tls.intercept: true:

apiVersion: core.riptides.io/v1alpha1
kind: WorkloadIdentity
metadata:
  name: claude
  namespace: riptides-system
spec:
  workloadID: claude
  selectors:
    - process:name: claude
  scope:
    daemonGroup:
      id: daemongroup/dev-eu-west-1/on-demand-workers
  connection:
    tls:
      mode: PERMISSIVE
      intercept: true

Next steps

Section titled “Next steps”