> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Platform services

> Console, Access Manager, Streaming Hub, Multi-tenancy, and Observability: the services that serve every Lerian product, what each one owns, and what you keep.

Console, Access Manager, Streaming Hub, Multi-tenancy, and Observability are platform services. They are not products themselves.

In BYOC you deploy them into your own cloud or data center alongside the products. In Lerian Cloud, Lerian operates them for you.

## The five services

***

<Columns cols={2}>
  <Card title="Lerian Console" icon="browser" href="/en/platform/console/about-lerian-console">
    One web interface for the products that ship a Console module.
  </Card>

  <Card title="Access Manager" icon="shield-keyhole" href="/en/platform/access-manager">
    Authentication and authorization for protected Lerian products: tokens, users, groups, applications, and MFA.
  </Card>

  <Card title="Streaming Hub" icon="tower-broadcast" href="/en/platform/streaming-hub/what-is-streaming-hub">
    Delivers platform events to destinations you own: webhook, pull cursor, SQS, RabbitMQ, and EventBridge. It consumes the internal stream and never produces onto it.
  </Card>

  <Card title="Multi-tenancy" icon="layer-group" href="/en/platform/multi-tenancy">
    One deployment serves independent tenants. Each product derives tenant context according to its own authentication contract.
  </Card>

  <Card title="Observability" icon="tower-observation" href="/en/platform/observability">
    Products export traces, metrics, and logs over OpenTelemetry to a collector.
  </Card>
</Columns>

## How the services sit around the products

***

```mermaid theme={null}
flowchart LR
  App["Your applications and operators"]
  Console["Lerian Console"]
  AM["Access Manager<br/>Auth and Identity"]
  Products["Lerian products"]
  Hub["Streaming Hub"]
  Sinks["Your webhook, queue, or cursor"]
  Otel["Your collector and telemetry backend"]
  IdP["Your identity provider (optional)"]
  App -->|"presents a token"| Products
  Products -->|"authorizes subject and action"| AM
  Console -->|"manages users and applications"| AM
  Console -->|"operates the modules"| Products
  Products -.->|"publish events"| Hub
  Hub -.->|"delivers, at least once"| Sinks
  Products -.->|"OTLP traces, metrics, logs"| Otel
  IdP -.->|"as an upstream provider"| AM
  classDef lerian fill:#fff8e1,stroke:#f4b400,color:#1f1f1f;
  classDef yours fill:#e8f0fe,stroke:#4285f4,color:#1f1f1f;
  classDef ext fill:#f1f3f4,stroke:#9aa0a6,color:#1f1f1f;
  class Console,AM,Products,Hub lerian;
  class App,Sinks,Otel,IdP yours;
```

The diagram shows five interactions.

1. Your application sends a bearer token to a product route that Access Manager protects. The product asks Access Manager whether that subject may perform the route's action, then admits or rejects it.
2. Lerian Console reads and writes access data through Access Manager, and operates each product module.
3. Streaming Hub matches events on the internal stream against your subscriptions and delivers each match.
4. Products push traces, metrics, and logs over OTLP to the collector address you set.
5. Your identity provider, when you run one, plugs into Access Manager as an upstream provider.

## Services and products

***

| Service | Midaz | Matcher | Flowker | Lender | Reporter | Streaming Hub | Brazil rails |
| - | - | - | - | - | - | - | - |
| Access Manager | protected routes | bearer token on protected routes | protected routes | protected routes, public jurisdiction reads | resource and action per route | the control plane | bearer token on protected routes, default differs per rail |
| Console | Midaz Module, with the plugins the Plugins screen shows | module | module | — | module | module | Pix Indirect (BTG), Payments, and, when enabled, Bank Transfer (TED JD) |
| Streaming Hub | fact topics | — | workflow trigger | fact topics | report completion facts | — | per rail |
| Multi-tenancy | organizations, ledgers, accounts, transactions | reconciliation resources | per-tenant database connections | tenant from the validated identity | data sources and reports | subscriptions isolated by tenant | per rail |
| Observability | OTLP export | — | OTLP export | telemetry toggle and endpoint | OTLP push | OTLP export | OTLP export |

## What you bring and what Lerian ships

***

You bring:

* Cloud infrastructure and Kubernetes clusters.
* Database administration and backups.
* Network security, container patching, and secrets management.
* Your monitoring pipelines and the collector that receives telemetry.
* The destinations Streaming Hub delivers to.
* Your identity provider. It connects to Access Manager as an upstream provider and does not replace the identity backend.

Lerian ships:

* Helm charts for supported products and infrastructure components, through an OCI-compatible registry.
* Terraform examples for the base infrastructure Midaz needs on AWS, GCP, or Azure.
* The Lifecycle dashboard for Enterprise BYOC.
* Access Manager and Lerian Console, as Enterprise features.

The Midaz chart lets you disable a bundled Valkey, PostgreSQL, MongoDB, or RabbitMQ and use an external service instead.

## Adopt one service at a time

***

<Steps>
  <Step title="Access Manager">
    Get the Auth and Identity services running with Caradhras, PostgreSQL, and Valkey. Then turn enforcement on per product. Install first, validate, then enable.
  </Step>

  <Step title="Lerian Console">
    Point the Console at Access Manager. Its user and application screens read and write that data.
  </Step>

  <Step title="Streaming Hub">
    Deploy the dedicated `streaming-hub-helm` chart, separate from any product chart. Its API routes require an Access Manager token.
  </Step>

  <Step title="Observability">
    Deploy a collector in your Kubernetes cluster. Then configure the product workloads that support it to send telemetry to it.
  </Step>
</Steps>

Multi-tenancy is not a step in that order. Lerian Cloud provides it.

## Deploy and operate

***

<Columns cols={2}>
  <Card title="Helm charts" icon="box" href="https://github.com/LerianStudio/helm">
    Install and upgrade the published charts.
  </Card>

  <Card title="Lifecycle Management" icon="arrows-spin" href="/en/platform/lifecycle-management">
    Orchestrate deployments in your own infrastructure and track versions.
  </Card>

  <Card title="Licensing" icon="key" href="/en/platform/licensing/license-manager">
    How a Lerian product validates its license key, and what each result allows.
  </Card>

  <Card title="Terraform examples" icon="cubes" href="/en/products/midaz/midaz-terraform-foundation">
    Create the network, DNS, database, and Kubernetes base Midaz needs on AWS, GCP, or Azure.
  </Card>
</Columns>

## Build with Narya

***

Narya runs coding agents behind one HTTP API. One long-lived host on your machine owns the sessions, the store and the model connections. Lerian ships a terminal client and a one-shot command on top of it, and you can write your own client against the same contract.

<Columns cols={2}>
  <Card title="Narya" icon="terminal" href="/en/platform/narya/what-is-narya">
    What Narya is, how you run it, and how it fits a pipeline.
  </Card>

  <Card title="The host API" icon="plug" href="/en/platform/narya/the-host-api">
    One contract for every client: socket, event stream, envelopes.
  </Card>
</Columns>

## Where to go next

***

[Deployment models](/en/start-here/evaluate-and-deploy/deployment-models) · [Multi-tenancy](/en/platform/multi-tenancy) · [What is Access Manager?](/en/platform/access-manager) · [What is Lerian Console?](/en/platform/console/about-lerian-console) · [Streaming Hub quick start](/en/platform/streaming-hub/streaming-hub-quick-start)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.