A secure control plane should make the approved path easier to understand than an improvised shortcut. TotalAuth models each identity relationship as a bounded contract: one repository, one project binding, one caller class, an exact audience, and a deliberately small role set. Changing the type of access means reviewing a new contract rather than silently widening the old one.

The gateways authenticate both the logical request and its execution context. Repository identity comes from canonical source configuration, local calls can be tied to operating-system peer credentials, and public access tokens must satisfy exact issuer, signature algorithm, audience, lifetime, and role requirements. Project-scoped operator approval remains visible instead of being replaced by permanent organization-wide automation authority.

Secret delivery is equally narrow. Credentials are generated in protected processes, stored as encrypted artifacts, and delivered only to the reviewed runtime consumer. Command output and handoff documents remain non-secret, so ordinary diagnostics, Git history, and application configuration do not become accidental credential channels.

Short-lived exchanges handle the places where one trust system must meet another. A machine identity can prove itself to a dedicated exchange and receive a narrowly scoped, rapidly expiring collaboration assertion. The exchange is not an administrator, proxy, or shared robot account. That distinction is the heart of TotalAuth: authentication becomes connective tissue without becoming a skeleton key.