Architecture map

This document maps the current Clawb system architecture from the codebase.

How to view visually

Caller	Main auth mode	Primary endpoints
Dashboard user (browser)	Session cookie (magic link login)	`/auth/`, `/v1/workspaces`, `/v1/agents`, `/v1/policies`, `/v1/vault/`
Enterprise backend/gateway	Workspace API key	`/v1/check`, `/v1/workspace/`, `/v1/identity/`
Agent runtime	Signature + nonce/timestamp via relying service or signed agent endpoints	`/v1/verify`, `/v1/telemetry/heartbeat`, vault signed endpoints
Public approval links	Opaque one-time tokens	`/v1/approval-links/`, `/v1/agent-approval/`, `/v1/policy-challenges/*`