iii-worker-manager

The iii-worker-manager is a mandatory engine worker that opens WebSocket listeners. The first entry in iii-config.yaml sets the main engine port (49134 by default) for trusted internal traffic; additional entries open separate listeners with their own RBAC, middleware, and registration hooks. Channels are mounted on every listener at /ws/channels/{channel_id} — RBAC ports keep engine::channels::create always-allowed via the infrastructure carve-out so SDK createChannel() works without changes.

When to Use

• Exposing the engine to an untrusted network — add a second iii-worker-manager entry with an rbac block and an auth_function_id instead of opening the main engine port.
• Restricting which functions a connected worker can invoke — combine expose_functions filters (operator-side) with forbidden_functions from AuthResult (per-session, hard deny).
• Auditing, rate-limiting, or enriching every invocation — set middleware_function_id on the listener; the middleware decides whether to call the target and what to return.
• Per-tenant or per-session namespace isolation — return function_registration_prefix from the auth function so every function/trigger this session registers is transparently prefixed without the worker code knowing.
• Gating dynamic registration — wire on_function_registration_function_id, on_trigger_registration_function_id, or on_trigger_type_registration_function_id to validate or rewrite registrations.

Boundaries