Setup & onboarding

Prism is Intrasys-managed: organizations and hardware are provisioned by Intrasys platform admins, not self-serve. This page describes that onboarding for admins.

Organizations

A platform admin creates an org (CLI prism org create or the Organizations page) and invites its first members (invites go out by email). Org settings include timezone (default Asia/Singapore), notification email, and alert destinations.

Members are invited under Organization → Users and assigned one of the four roles.

Sites

Create Sites under Sites before assigning Facets, so devices land in the right physical group. Indoor Sites carry building / floor / zone; outdoor Sites carry coordinates.

Provisioning a Facet

A Facet is a single-board computer running the Facet Agent (a systemd service, packaged as a .deb for Raspberry Pi OS / Ubuntu). There are three ways to get one onto the platform:

1. Adoption token

A platform admin mints a single-use adoption token scoped to an org (and optionally a Site). The agent uses it on first boot to announce itself. Tokens can be manual (an admin approves in the queue) or auto-adopt (the device is adopted automatically).

2. USB provisioning bundle

For batches, an admin generates a provisioning bundle (a zip) containing a rendered config.yaml and install instructions, with one adoption token per Facet. Drop it on the device and the agent self-configures.

3. Hardware registry

An admin pre-registers devices in the Hardware Registry (hardware id, type, driver, org/site, label). When such a device first announces itself, Prism matches it by hardware id and promotes it from pre-provisioned to adopted automatically.

Adoption handshake

However it's provisioned, the agent connects to Prism's MQTT broker over TLS and announces itself with its capability manifest. If a valid auto-adopt token is present it's adopted immediately; otherwise it enters the Adoption Queue where an admin approves or rejects it and assigns it to the org and a Site.

On adoption the platform issues a permanent per-facet credential (stored on the device at /var/lib/prism-agent/credentials.json, 0600) and confines the device to its own topic namespace. Credentials can be rotated (prism facet rotate-credential); a device that keeps failing authentication wipes its credential and re-announces to recover automatically.

The Facet Agent

• Python service, installed as a .deb; config at /etc/prism-agent/config.yaml.
• Buffers Signals locally (SQLite FIFO) so events survive a restart or a network blip.
• Ships drivers for Chainway and Impinj RFID readers, cameras (RTSP/USB), barcode scanners, and GPIO. New Facet types are added by capability manifest, without platform code changes.

Environments

Prism runs as a single production environment. The org-facing surfaces are:

Host	Purpose
console.prism.intrasys.ai	The web console.
api.prism.intrasys.ai	The REST API.
mcp.prism.intrasys.ai	The MCP connector.

note

An on-premises / airgapped edition is available for government, defense, and industrial deployments that need everything inside a customer-controlled network. Talk to Intrasys about scope and packaging.