slug: topaz
provider: Topaz
generated_by: planning/capability-mapping/scripts/classify_capabilities.py
model: claude-opus-5
frame:
- Software & Technology
min_confidence: 0.7
capability_model:
  source: https://github.com/vincentmakes/turbo-ea-capabilities
  license: CC-BY-4.0
  attribution: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities,
    CC BY 4.0
  notice: NOTICE
edge_count: 5
edges:
- tag: Authorizer
  spec_file: topaz-authorizer-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.92
  evidence: POST /api/v2/authz/is  is  Is (authorization decision)
  reason: Runtime authorization decision engine ('fine-grained, policy-based, real-time access control',
    IdentityContext/PolicyContext/IsRequest). Squarely Identity & Access Management; the product is an
    authorizer, so access control is the capability it realises.
- tag: Directory Checks
  spec_file: topaz-directory-checks-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.85
  evidence: POST /api/v3/directory/check  check (CheckRequest/CheckResponse); GET /api/v3/directory/graph  Get
    graph
  reason: Zanzibar-style permission check and relationship-graph traversal used to evaluate whether a
    subject may access an object — access-control evaluation, i.e. Identity & Access Management.
- tag: Directory Objects
  spec_file: topaz-directory-objects-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.8
  evidence: POST /api/v3/directory/object  setObject; GET /api/v3/directory/objects/{object_type}  List
    objects of a type
  reason: CRUD over the authorization directory's object graph (users, groups, resources) that backs RBAC/ReBAC/ABAC
    decisions. Generic 'object' naming adds some ambiguity, but the vendor description ties the directory
    explicitly to access control, so IAM is the honest mapping.
- tag: Directory Relations
  spec_file: topaz-directory-relations-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.8
  evidence: POST /api/v3/directory/relation  setRelation; GET /api/v3/directory/relations  List relations
  reason: Management of relationship tuples in the Zanzibar-style directory ('model RBAC, ReBAC, and ABAC
    over an object graph'); these relations are the grant structure for access decisions, hence Identity
    & Access Management rather than any data-modelling capability.
- tag: Policies
  spec_file: topaz-policies-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.72
  evidence: '"List loaded policy modules" / "Get a policy module" in an "authorizer for fine-grained,
    policy-based, real-time access control"'
  reason: The policies here are OPA authorization policy modules driving access-control decisions (RBAC/ReBAC/ABAC),
    i.e. identity & access management tooling — not corporate policy lifecycle management (BC-130.20),
    which the tag string might otherwise suggest.