elsa-core/docs/adr/0003-extend-authentication-through-deployed-descriptor-providers.md

# Extend authentication through deployed descriptor providers

**Status**: V1 Permission Grant Source portion superseded by [0009](0009-match-unlinked-identities-with-trusted-user-matchers.md)

Trusted Protocol Adapters, Unlinked Identity Policies, and Permission Grant Sources are deployed code registered when Elsa starts, while their selected instances and versioned settings are runtime connection data. Connections use a protocol-neutral envelope with adapter-owned JSON settings and Secret Bindings, and providers expose descriptors from which Studio renders standard forms with optional custom-editor overrides. New extension code may require deployment and restart, but configuration changes for installed providers take effect live without database schema changes.
Add external authentication broker 2026-07-24 16:59:17 +00:00			`# Extend authentication through deployed descriptor providers`

Revise external authentication architecture 2026-07-25 00:35:56 +00:00			`Status: V1 Permission Grant Source portion superseded by [0009](0009-match-unlinked-identities-with-trusted-user-matchers.md)`

Add external authentication broker 2026-07-24 16:59:17 +00:00			Trusted Protocol Adapters, Unlinked Identity Policies, and Permission Grant Sources are deployed code registered when Elsa starts, while their selected instances and versioned settings are runtime connection data. Connections use a protocol-neutral envelope with adapter-owned JSON settings and Secret Bindings, and providers expose descriptors from which Studio renders standard forms with optional custom-editor overrides. New extension code may require deployment and restart, but configuration changes for installed providers take effect live without database schema changes.