Identity and access layer: design for internal AI apps

I led the design of a shared identity and access layer for Openprovider's internal AI apps, taking it from research through a PRD and a technical spec. This is design work, and no code has been written for it.

The goal is one shared layer, so that each app doesn't have to solve sign-in, roles and AI keys on its own. The design puts OIDC with PKCE and a self-hosted identity provider in front of the apps, uses workload identity for services, and issues LLM virtual keys with budgets, so every key has an owner and a ceiling.

Getting there meant comparing identity providers, gateways and authorization engines on the evidence for and against each, then writing a design that every app could adopt the same way.