[teodortonchev-redis]

Summary

Two corrections to the self-managed Redis Iris 1.0 pages, so that they agree with the 1.0 code. Ticket: MOD-20066. The same corrections are in the Iris repository: redislabsdev/iris#2544 (main) and redislabsdev/iris#2559 (release/iris-on-prem-v1.0).

Agent Memory: Data Plane auth modes

The page said that the Data Plane uses agent-key authentication whenever the configuration sets no auth method. The Data Plane uses this default only when the configuration also enables no other auth provider, such as OIDC or worker identity. The page now states this condition and tells the reader to set auth.method: agent_key explicitly.

Intent Router: Authentication and authorization

The page said that every Router operation needs the admin token. In 1.0, the control plane also accepts operator access tokens from the IdP when you configure OIDC. The page now:

• lists the operator access token in the credentials table;
• names the admin token or an operator access token as the control-plane credential;
• says how the suite configures control-plane OIDC (global.iris.auth.oidc, global.iris.auth.roleBindings with the product intent);
• gives the access of each role: viewer reads, operator also creates and changes Routers, and product_admin and suite_admin also delete Routers.

Testing

• vale on both pages: no new issues.
• I checked both claims against the 1.0 code: the Memory auth default logic, and the Intent control-plane route policy and role sets.

🤖 Generated with Claude Code

---

Note

Low Risk
Documentation-only corrections; no runtime or security logic changes.

Overview
Aligns self-managed Agent Memory and Intent Router auth docs with Iris 1.0 behavior.

Agent Memory narrows when the Data Plane implicitly defaults to agent-key auth: only when no auth method is set and no other provider (OIDC, worker identity) is enabled; readers are told to set auth.method: agent_key explicitly for reviewable security posture.

Intent Router expands from two to three credential types by documenting operator access tokens (IdP/OIDC) for control-plane admin. Router operations may use the admin token or an OIDC operator token; the page adds a credentials-table row, global.iris.auth.oidc / roleBindings (product intent), a role matrix (viewer, operator, product_admin, suite_admin), and clarifies admin-token-only use when OIDC is off.

^{Reviewed by Cursor Bugbot for commit 4b0835d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

All committers have signed the CLA.