From 68542b5388371f573b1c0b6d2e5cfcbc4371abaf Mon Sep 17 00:00:00 2001 From: abrichr Date: Thu, 30 Jul 2026 12:39:43 -0400 Subject: [PATCH] docs: define BYOC at customer-controlled boundary --- docs/commercial/deployment-boundaries.md | 8 +++++--- docs/commercial/execute-api.md | 10 ++++++++++ docs/concepts/deployment-matrix.md | 9 ++++++++- docs/reference/glossary.md | 23 +++++++++++++++++++++++ mkdocs.yml | 1 + 5 files changed, 47 insertions(+), 4 deletions(-) create mode 100644 docs/reference/glossary.md diff --git a/docs/commercial/deployment-boundaries.md b/docs/commercial/deployment-boundaries.md index 7bcb0d1..5490e7b 100644 --- a/docs/commercial/deployment-boundaries.md +++ b/docs/commercial/deployment-boundaries.md @@ -57,9 +57,11 @@ flowchart LR ### Lane 2: Customer-controlled runner - **What runs where:** execution runs on infrastructure the customer controls - (workstation, server, VM, or customer cloud account). This is the standard - lane for regulated or sensitive workflows, including the published RVU audit - case study deployment shape. + (workstation, server, VM, or customer cloud account). A customer-owned cloud + runner and storage boundary can use the existing + [bring your own cloud (BYOC)](../reference/glossary.md#byoc) connector. This + is the standard lane for regulated or sensitive workflows, including the + published RVU audit case study deployment shape. - **Where sensitive data lives:** live frames, OCR text, injected parameters, and verifier values stay inside the customer boundary. If PHI appears on screen at run time, it never leaves. diff --git a/docs/commercial/execute-api.md b/docs/commercial/execute-api.md index 0ad7c2d..5d24a3e 100644 --- a/docs/commercial/execute-api.md +++ b/docs/commercial/execute-api.md @@ -8,6 +8,16 @@ and waits for a terminal receipt. This guide is for an approved private-pilot partner. OpenAdapt supplies the service credential and the identifiers from the qualification pack. +## Choose where execution runs + +Execute can dispatch to an approved managed runner or to a customer-controlled +runner. A customer-owned cloud runner and storage boundary can use the existing +[bring your own cloud (BYOC)](../reference/glossary.md#byoc) connector. The +customer runner executes the workflow. Cloud carries bounded authorization and +control metadata and receives only the declared result and evidence allowed by +the data boundary. Other customer-controlled deployments can use a workstation, +server, or on-premises virtual machine without using BYOC. + ## Authenticate the service OpenAdapt issues one service token. The token is restricted to one organization diff --git a/docs/concepts/deployment-matrix.md b/docs/concepts/deployment-matrix.md index 3418538..73cd167 100644 --- a/docs/concepts/deployment-matrix.md +++ b/docs/concepts/deployment-matrix.md @@ -9,7 +9,7 @@ schema. What differs across lanes is data handling, not substrate capability. | Deployment / substrate | Browser | Windows UIA | Native macOS | Native Linux | RDP | Citrix / VDI | |---|---|---|---|---|---|---| | **OpenAdapt Hosted** | Managed execution, schedules, reports, usage, and billing | Customer-controlled runtime connected to Cloud | Customer-controlled runtime connected to Cloud | Customer-controlled runtime connected to Cloud | Customer-controlled runtime connected to Cloud | Customer-controlled runtime connected to Cloud | -| **Customer cloud / BYOC** | Customer runner and storage with managed governance | Customer runner and storage | Customer runner and storage | Customer runner and storage | Customer runner and storage | Customer runner and storage | +| **Customer cloud / bring your own cloud (BYOC)** | Customer runner and storage with managed governance | Customer runner and storage | Customer runner and storage | Customer runner and storage | Customer runner and storage | Customer runner and storage | | **Self-hosted / on-prem** | Local runner and audit trail | Local runner and audit trail | Local runner and audit trail | Local runner and audit trail | Local runner and audit trail | Local runner and audit trail | Every substrate is a first-class target of the shared compiler, runner, and @@ -27,6 +27,13 @@ entitlement. The matrix describes the product architecture; the [qualification appendix](../get-started/what-works-today.md) and commercial terms define the accepted workload and entitlement. +In the existing BYOC connector and configuration, a runner and storage inside a +customer-owned cloud boundary execute the workflow. OpenAdapt Cloud can send +bounded authorization and control metadata and receive the declared result and +evidence permitted by the data boundary. Other customer-controlled deployments +can run on a workstation, server, or on-premises virtual machine without being +BYOC. See the [glossary](../reference/glossary.md#byoc). + ## Artifact boundary and runtime boundary Two boundaries must be reviewed independently: diff --git a/docs/reference/glossary.md b/docs/reference/glossary.md new file mode 100644 index 0000000..4419f6b --- /dev/null +++ b/docs/reference/glossary.md @@ -0,0 +1,23 @@ +# Glossary + +Short definitions for terms used across OpenAdapt. + +## BYOC + +**Bring your own cloud (BYOC)** is the existing OpenAdapt connector and +configuration name for a customer-owned cloud runner and storage boundary. + +OpenAdapt Cloud can send bounded authorization and control metadata to that +runner. Cloud receives only the declared result and evidence permitted by the +deployment data boundary. Live screenshots, sensitive parameters, and verifier +values can remain inside the customer boundary. + +The broader public term is **customer-controlled execution**. A +customer-controlled runner can also run on a workstation, server, or +on-premises virtual machine. Those deployments do not have to use BYOC. + +BYOC does not mean bring your own compute. It does not mean customer-provided +source code. It does not grant unrestricted access to OpenAdapt Cloud. + +See [Deployment boundaries](../commercial/deployment-boundaries.md) and +[Integrate OpenAdapt Execute](../commercial/execute-api.md). diff --git a/mkdocs.yml b/mkdocs.yml index 60dfdcc..a4fdb45 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -181,6 +181,7 @@ nav: - Deployment configuration: reference/deployment-config.md - The bundle format: reference/bundle-format.md - Configuration and env vars: reference/configuration.md + - Glossary: reference/glossary.md - Package and repository lifecycle: ecosystem/index.md - Documentation source of truth: reference/documentation-governance.md - What's New: whats-new.md