Security Architecture: Universal OIDC + SMS 2FA, Zero Passwords & Tenant Isolation
How Research Triangle Park AI Transformation LLC secures its executive backend (/admin/), Paid 3-Layer Second-Brain API partitions, and enterprise client engagements.
Four Non-Negotiable Identity & Security Rules Across All Surfaces
Aligned with NIST SP 800-63B Digital Identity Guidelines (.gov), our Identity, Auth & Security architecture enforces four uniform rules across /admin/, Paid Second-Brain API tenant customers, and all customer-facing logins:
| Security Rule | Technical Enforcement | Covered Surfaces | Status |
|---|---|---|---|
| 1. Universal OpenID Connect (OIDC) | OAuth 2.0 authorization_code + PKCE S256 & Web Crypto RS256 JWKS verification across Google, Apple, Facebook, and Enterprise IdPs (Microsoft Entra, GitHub, Okta) | /admin/, Paid Second-Brain API Tenants & Public Profiles | ENFORCED |
| 2. Absolute Ban on Manual Passwords | password_auth_prohibited = true — Zero manual username/password forms or password credential databases anywhere | All RTP AIT LLC Properties | ENFORCED |
| 3. OIDC + Mandatory SMS 2FA | Primary federated OIDC identity factor paired with SMS-based two-factor authentication (SMS_2FA) as required second factor | /admin/, API Tenant Provisioning & Client Portals | ENFORCED |
| 4. Tenant-Based Access Partitioning | Paid Second-Brain API customers receive an isolated /tenants/{tenant_id}/ partition cloned from our sanitized Golden Template (zero_founder_contamination = true) | Paid 3-Layer Second-Brain API | Open OIDC /admin/ |
Frequently Asked Questions
Does RTP AI Transformation serve clients outside North Carolina and globally?
Yes. RTP AI Transformation connects organizations anywhere in the United States and globally with senior AI engineers, systems architects, and research talent residing in North Carolina's Research Triangle Park via remote-first and hybrid Forward-Deployed Velocity Pods.
What is the 7-Step Agentic Org Maturity Ladder?
It is RTP AIT LLC's quantitative engineering framework progressing from Step 1 (human-run AI tool silos) and Step 2 (scoped MCP context layers) through Step 3 (Golden Dataset harnesses), Step 4 (unattended headless daemons), Step 5 (90-day agent/secret TTL governance), Step 6 (quality-gated handoffs), and Step 7 (exception-only human queues).
How are RTP AIT LLC's B2B consulting service lines priced?
Service Line 1 is a fixed-fee 2-Week AI Readiness & 7-Step Maturity Diagnostic ($15,000-$25,000). Service Line 2 is a 6-8 Week Forward-Deployed Harness & Headless Execution Build ($45,000-$120,000). Service Line 3 is a Managed Governance, Eval Ratchet & Kaizen Retainer ($10,000-$25,000/mo).
How does Paid API Access to the 3-Layer JSON-Node Second Brain isolate customer data?
When an external customer subscribes to the Paid Second-Brain API Tier, the platform provisions a dedicated tenant partition (/tenants/{tenant_id}/) by cloning RTP AIT's master 3-Layer JSON-Node Second Brain structure (stripped of private founder data) as a Golden Template, enforcing zero context drift and zero founder contamination.
What authentication standard governs rtpait.com and the /admin/ backend?
All surfaces enforce Universal OpenID Connect (Google, Apple, Facebook, and enterprise IdPs) paired with SMS-based two-factor authentication (SMS 2FA) and an absolute ban on manual username-and-password authentication (password_auth_prohibited = true). Access to /admin/ is cryptographically restricted to luke@rtpait.com.