iii-worker-manager

The iii-worker-manager is a mandatory engine worker that opens WebSocket listeners. The base engine.workers.iii-worker-manager entry sets the main port (49134 by default); #instance entries open separate listeners with their own RBAC, middleware, and registration hooks. Channels are mounted on every listener at /ws/channels/{channel_id}.

When to Use

• Exposing the engine to an untrusted network — add a second iii-worker-manager entry with an rbac block and an auth_function_id instead of opening the main engine port.
• Restricting which functions a connected worker can invoke — combine expose_functions filters (operator-side) with forbidden_functions from AuthResult (per-session, hard deny).
• Auditing, rate-limiting, or enriching every invocation — set middleware_function_id on the listener; the middleware decides whether to call the target and what to return.
• Per-tenant or per-session namespace isolation — return function_registration_prefix from the auth function so every function/trigger this session registers is transparently prefixed without the worker code knowing.
• Gating dynamic registration — wire on_function_registration_function_id, on_trigger_registration_function_id, or on_trigger_type_registration_function_id to validate or rewrite registrations.

Boundaries