digraph techviz {
  graph [rankdir=LR, splines=ortho, nodesep=0.55, ranksep=0.85];
  node [fontname=Helvetica, fontsize=11, margin="0.18,0.12", style="rounded,filled", fillcolor=white, color="#2d4357", penwidth=1.5];
  edge [fontname=Helvetica, fontsize=10, color="#364b5f", penwidth=1.4, arrowsize=0.75];
  subgraph cluster_0 {
    label="Upstream IdP";
    style="rounded,dashed";
    color="#66788a";
    n0 [label="Google IdP", shape=box, style="rounded,filled"];
  }
  subgraph cluster_1 {
    label="Keycloak → Application";
    style="rounded,dashed";
    color="#66788a";
    n1 [label="Keycloak broker", shape=box, style="rounded,filled"];
    n2 [label="Keycloak authorization code", shape=box, style="rounded,filled"];
    n3 [label="AP1 · AP2 · AP3 · AP4", shape=box, style="rounded,filled"];
  }
  n0 -> n1 [label="identity assertion", style=solid];
  n1 -> n2 [label="issue code", style=solid];
  n2 -> n3 [label="Keycloak issuer", style=solid];
}