{
  "generator": "built-in image_gen.imagegen",
  "date": "2026-10-05",
  "images": [
    {
      "vendor": "google",
      "prompt": "Use case: infographic-diagram. Create a polished Chinese technical architecture diagram for an engineering Markdown document. Landscape 16:9, high resolution, crisp large Chinese sans-serif labels, white background, restrained blue/teal with orange for external untrusted inputs. Flat rounded boxes, clear directional arrows, generous spacing, no logos, no decorative art. Each arrow must have unambiguous direction. Distinguish official provider capabilities from custom integration using a blue container labeled '厂商能力' and teal container labeled '本系统设计'. Footer exact text '认证输出可信身份；业务授权由项目负责'. Do not imply login proves software origin. Use only the labels and flows specified below; avoid tiny text.\nTitle: 'Google · Agent 身份认证架构'. Two independent horizontal lanes converging on custom Broker. Top lane: '本地 Agent' → '浏览器登录 / PKCE' → 'Broker 联合 Google 登录'. Google provider small box 'Google 用户身份'. User identity feeds Broker. Bottom lane: 'Google 托管 Agent' → Google provider box 'Agent Identity / STS OIDC' → custom '工作负载验证'. Converge inside teal custom container '认证 Broker' with sublabels '用户映射 · 工作负载映射 · 会话绑定'. Arrow from Broker to '项目身份凭证' then to separate '项目验签' then '项目自主授权'. Small note under top lane '软件来源默认未验证'. Small note under bottom lane '外部 OIDC 默认 bearer'. Do not show Google token directly authorizing project business access.",
      "edit_prompt": null,
      "path": "docs/public/images/agent-identity/google-architecture.png",
      "source_file": "exec-de5aaf94-5622-4298-8b98-c2084e9a3c47.png"
    },
    {
      "vendor": "microsoft",
      "prompt": "Use case: infographic-diagram. Create a polished Chinese technical architecture diagram for an engineering Markdown document. Landscape 16:9, high resolution, crisp large Chinese sans-serif labels, white background, restrained blue/teal with orange for external untrusted inputs. Flat rounded boxes, clear directional arrows, generous spacing, no logos, no decorative art. Each arrow must have unambiguous direction. Distinguish official provider capabilities from custom integration using a blue container labeled '厂商能力' and teal container labeled '本系统设计'. Footer exact text '认证输出可信身份；业务授权由项目负责'. Do not imply login proves software origin. Use only the labels and flows specified below; avoid tiny text.\nTitle: 'Microsoft · Entra Agent ID 架构'. Main sequence left to right: '本地公共客户端' → '用户登录' → '服务端 Blueprint' → '子 Agent identity' → '目标 API'. Provider container label '厂商能力 · Entra ID' contains two exchanges: 'Blueprint 凭证 → T1' and 'T1 + 用户 Tc → OBO 资源令牌'. Top note 'Tc 受众 = Blueprint'. Arrow labeled '资源令牌' to target API; target label '目标 API 自主授权'. Separate lower custom lane: '认证 Broker' → '内部项目凭证' → '项目验签与自主授权'. User login feeds Broker too. Small left lower box '服务器沙箱 / 托管身份或 FIC' feeds server Blueprint. Footer aside '用户主体与 Agent 调用者分开记录'. Note 'Blueprint 凭证仅在服务端'. No direct interactive login into child Agent identity.",
      "edit_prompt": "Correct the top architecture of this diagram while preserving typography, title, colors and lower custom Broker lane. Replace the entire top sequence with three clearly numbered rows, no other arrows: Row 1 '本地公共客户端' → 'Entra 用户登录' → '用户令牌 Tc' → '服务端 Blueprint'; note 'Tc 受众 = Blueprint'. Row 2 '服务端 Blueprint 凭证' → 'Entra 交换端点' → 'T1'; note '凭证仅在服务端'. Row 3 '子 Agent：T1 + Tc' → 'Entra OBO 端点' → '资源令牌' → '目标 API 自主授权'. Put the three Entra endpoint boxes in blue style labeled '厂商能力', and endpoint calls not as a single wrong chain. Remove the old servers/sandbox boxes if needed to simplify. Keep bottom Broker lane but remove the vertical arrow from local public client to Broker so it stands as a distinct custom integration alternative. Footer stays unchanged. Do not put T1 generation before Blueprint.",
      "path": "docs/public/images/agent-identity/microsoft-architecture.png",
      "source_file": "exec-e062b9e8-2f9a-432a-ab20-cff0e3e8bdd9.png"
    },
    {
      "vendor": "aws",
      "prompt": "Use case: infographic-diagram. Create a polished Chinese technical architecture diagram for an engineering Markdown document. Landscape 16:9, high resolution, crisp large Chinese sans-serif labels, white background, restrained blue/teal with orange for external untrusted inputs. Flat rounded boxes, clear directional arrows, generous spacing, no logos, no decorative art. Each arrow must have unambiguous direction. Distinguish official provider capabilities from custom integration using a blue container labeled '厂商能力' and teal container labeled '本系统设计'. Footer exact text '认证输出可信身份；业务授权由项目负责'. Do not imply login proves software origin. Use only the labels and flows specified below; avoid tiny text.\nTitle: 'AWS · AgentCore 身份与凭证架构'. Official main lane: '用户 / 调用服务' → 'Runtime 入站验证' (subtitle 'JWT 或 IAM') → 'Agent / 工作负载身份' → 'WAT' → 'AgentCore 凭证提供商' → '目标资源凭证' → '目标 API'. Blue provider container encloses Runtime through credential provider. Keep this main lane legible, use two rows if needed. Bold note next to WAT '仅用于 AgentCore 服务'. Lower separate custom lane: '已验证用户 / 工作负载' → teal '本系统 Broker' → '项目身份凭证' → '项目验签与自主授权'. Do not connect WAT to project. Small note 'UserId 字符串不能替代用户认证'. Footer exact supplied.",
      "edit_prompt": null,
      "path": "docs/public/images/agent-identity/aws-architecture.png",
      "source_file": "exec-4729c2c2-2a8a-47e6-b9b4-bfb58cbcbc4d.png"
    },
    {
      "vendor": "alibaba",
      "prompt": "Use case: infographic-diagram. Create a polished Chinese technical architecture diagram for an engineering Markdown document. Landscape 16:9, high resolution, crisp large Chinese sans-serif labels, white background, restrained blue/teal with orange for external untrusted inputs. Flat rounded boxes, clear directional arrows, generous spacing, no logos, no decorative art. Each arrow must have unambiguous direction. Distinguish official provider capabilities from custom integration using a blue container labeled '厂商能力' and teal container labeled '本系统设计'. Footer exact text '认证输出可信身份；业务授权由项目负责'. Do not imply login proves software origin. Use only the labels and flows specified below; avoid tiny text.\nTitle: '阿里云 · Agent Identity 认证架构'. Left upper box '用户登录 / OIDC JWT', left lower box '沙箱 / RAM 临时凭证'. Both flow into blue provider container '厂商能力 · Agent Identity' with clear independent checks '用户 JWT 校验' and 'OpenAPI 签名校验'. These converge to '工作负载 + 用户上下文' then 'WAT' then '凭证提供商' then external '目标资源'. Note under WAT '不透明令牌'. Separate teal custom bottom lane: '本系统 Broker' → '项目身份凭证' → '项目验签与自主授权'. Broker receives verified user and workload evidence, not a decoded WAT. Small note '本地 Agent 不保存长期 AK/SK'. Small note '用户身份与运行身份分别校验'.",
      "edit_prompt": "Make one architectural correction: remove BOTH vertical arrows and their labels between the blue provider area and the teal custom area. These falsely imply a native WAT-to-project identity conversion. In the empty lower left area add a small orange box '独立验证的用户 / 工作负载证据' with ONE horizontal arrow entering ONLY '本系统 Broker'. Keep the bottom lane Broker → 项目身份凭证 → 项目验签与自主授权. All upper official boxes and arrows remain unchanged. No arrows from WAT or provider area into the bottom lane. Preserve title, colors, legibility and footer.",
      "path": "docs/public/images/agent-identity/alibaba-architecture.png",
      "source_file": "exec-e248b4db-40fc-4e60-878e-27dee0d8da0b.png"
    },
    {
      "vendor": "volcengine",
      "prompt": "Use case: infographic-diagram. Create a polished Chinese technical architecture diagram for an engineering Markdown document. Landscape 16:9, high resolution, crisp large Chinese sans-serif labels, white background, restrained blue/teal with orange for external untrusted inputs. Flat rounded boxes, clear directional arrows, generous spacing, no logos, no decorative art. Each arrow must have unambiguous direction. Distinguish official provider capabilities from custom integration using a blue container labeled '厂商能力' and teal container labeled '本系统设计'. Footer exact text '认证输出可信身份；业务授权由项目负责'. Do not imply login proves software origin. Use only the labels and flows specified below; avoid tiny text.\nTitle: '火山引擎 · 工作负载身份架构'. Left inputs two boxes '可信外部 JWT' and 'ECS 平台证据', arrows enter blue container '厂商能力 · Workload Pool'. Inside: 'Trust Anchor' → '身份映射 / 条件校验' → 'Workload Identity'. Another left box '用户登录上下文' feeds '用户绑定' beside identity. Identity and user binding converge to '工作负载访问令牌' then '支持该协议的下游'. Separate custom lower lane '本系统验证适配器' → '内部项目凭证' → '项目验签与自主授权'. Note '信任锚验证凭证来源'. Note '工作负载身份不等于软件来源证明'. Do not imply any arbitrary project can decode TIP. Big readable text.",
      "edit_prompt": "Correct ONLY three explanatory text snippets while preserving all boxes, arrows and layout: under '本系统验证适配器' replace current text with exactly '依据明确验证契约接入；不默认解析 WAT'. Under '内部项目凭证' replace current text with '由本系统签发，绑定目标受众'. Under '工作负载访问令牌' replace explanatory text with '按接收方支持的协议使用'. Preserve rest. No native universal WAT decoding claim.",
      "path": "docs/public/images/agent-identity/volcengine-architecture.png",
      "source_file": "exec-d7f8dcbf-4f22-431a-85fc-87149b52306c.png"
    },
    {
      "vendor": "tencent",
      "prompt": "Use case: infographic-diagram. Create a polished Chinese technical architecture diagram for an engineering Markdown document. Landscape 16:9, high resolution, crisp large Chinese sans-serif labels, white background, restrained blue/teal with orange for external untrusted inputs. Flat rounded boxes, clear directional arrows, generous spacing, no logos, no decorative art. Each arrow must have unambiguous direction. Distinguish official provider capabilities from custom integration using a blue container labeled '厂商能力' and teal container labeled '本系统设计'. Footer exact text '认证输出可信身份；业务授权由项目负责'. Do not imply login proves software origin. Use only the labels and flows specified below; avoid tiny text.\nTitle: '腾讯云 · Agent 网关认证架构'. Left upper '本地 Agent / 浏览器登录', left lower '服务器沙箱 / 工作负载凭证'. Both enter teal custom '本系统 Broker' with subtitle '用户与运行身份验证'. Then '项目受众凭证' → blue official 'AI Agent 安全网关' with two alternative inner labels 'JWT + JWK' and '远程令牌验证'. Then arrow '可信转发或原凭证' → '项目核验' → '项目自主授权'. Note near project '必须校验目标 audience'. Bottom note '沙箱身份适配由本系统补齐'. Second note '企业微信 AgentID ≠ AI Agent 实例身份'. No claim of native sandbox attestation in gateway.",
      "edit_prompt": null,
      "path": "docs/public/images/agent-identity/tencent-architecture.png",
      "source_file": "exec-db91139b-6da0-4319-9ff4-fb523b4008d2.png"
    }
  ]
}