Platform architecture

Atlan Trident holds the skills, agent records, releases, and execution evidence that a team shares. AI Gateway connects clients to models and MCP tools. Your agents can run in a coding client, an application framework, or a supported local runtime; their Registry record identifies them and links their evidence.

Identity and access

People sign in using the methods configured for their organization. Company SSO can be optional or required; the policy is separate from organization admission and workspace access. Scripts and services use their own credentials, and agents can act with their own identity or with a person’s approved delegated access. The authenticated identity determines the organization and permissions available to a request. Organization settings and workspace content have separate access controls. A workspace ID is a target, not a grant of access. See Choose security controls and Workspace roles and access.

Registry records and content

Skills and agents belong to workspaces. A saved version records a particular state; a release selects a version for consumption under a channel and release policy. Skill packages can contain instructions and supporting files. Relationships connect records such as an agent and the skills it uses. Keep these questions separate when reviewing a record:

• Who can read or change it?
• Which version was saved or released?
• What source supplied its content?
• Which runs were attributed to it?

Work with skills and Manage agents explain those lifecycles.

Execution evidence

The SDK, coding-agent capture, and compatible OpenTelemetry exporters send traces. Sessions group related execution evidence. Attribution connects that evidence to the agent, user, skill, or version identifiers supplied or resolved for the run. Trace content and usage analytics have separate privacy controls. Stored cost also depends on the token evidence and model rates available for the run; it is not a provider invoice. Evals add scores and experiment results so you can compare behavior across cases and versions. See Monitor agents.

Gateway connections

Model Gateway provides model discovery and supported provider-compatible request interfaces. The usable catalog depends on configured providers and access; a model name alone does not establish support for every request parameter or modality. MCP Gateway combines Atlan platform tools with tools from registered downstream MCP servers. The callable catalog depends on the signed-in identity, installed applications, and connected services. A downstream connection may also need its own OAuth sign-in or credential. Use live tool discovery to check the names and schemas available to a client.

Where Atlan Trident runs

Atlan Trident is a multi-tenant SaaS service on AWS in US East (N. Virginia), us-east-1. Your content lives in object storage; the database keeps metadata.

1. People sign in with your identity provider at auth.atlan.com, through Cloudflare.
2. The desktop app, the web app and your agents call the registry at api.atlan.com, through Cloudflare.
3. The registry validates each request with Authentication internally, over AWS PrivateLink.
4. The registry stores metadata in an Amazon Aurora PostgreSQL database in the control plane: accounts, registry records and versions, the search index, runs and usage, and the audit log. For secrets, it stores only references; the values are held in a vault.
5. The registry stores your content, including skills, files, chats and traces, in Amazon S3 in the data plane.

AI inference runs on Amazon Bedrock, with models in US regions.

Deployment and security review

Atlan Trident runs under your organization’s agreement with Atlan. For Atlan’s security practices and compliance reports, see the Atlan Trust Center; for how Atlan handles personal data, see the Atlan Privacy Policy. For your organization’s retention terms, network controls and subprocessors, contact your Atlan account team.