---
id: GLAS-WP-0018
type: workplan
title: "Session-scoped agent identity, attribution and tool boundary"
domain: infotech
repo: glas-harness
status: proposed
flavor: implementation
owner: claude
topic_slug: session-agent-identity-tool-boundary
created: "2026-10-24"
updated: "2026-10-24"
---

# Session-scoped agent identity, attribution and tool boundary

Request: net-kingdom message 14ea093a (service-identity-privilege_v0.1 draft-3,
SI-14, SI-15; SEC-DSM DSM-AGENT-002, -007, -008). Assessment:
`history/2026-10-24-agent-session-identity-and-tool-boundary-assessment.md`.
Status is `proposed`: needs founder approval and key-cape / sand-boxer replies
before T04. T01 to T03 have no external dependency. No harness behavior has been
changed by drafting this plan.

## Contract fields and evidence

```task
id: GLAS-WP-0018-T01
status: todo
priority: high
```

Add optional `identity_ref` (subject, act.sub, jti, issuer, expiry; never the
token), `session_id` and `on_behalf_of` to the request and `ExecutionEvidence`.
Add hashed evidence-receipt location and sha256. Tests; backwards compatible.

## Boundary declaration and tool-profile echo check

```task
id: GLAS-WP-0018-T02
status: todo
priority: high
```

Add a profile `boundary` block, record it in evidence, and fail the run when the
rein reports a tool profile different from the requested one. Catalog validation:
profiles with credential routes or an identity requirement must name a
non-default tool profile. Request rein-aharness to export its tool-profile
manifest.

## Issuer interface and fail-closed path

```task
id: GLAS-WP-0018-T03
status: todo
priority: medium
```

Define `AgentIdentityIssuer` with a test double. Gateway obtains a per-run token
(ttl = min(profile, remaining timeout, 3600)), fails closed with a new
`identity` failure stage, redacts the token pattern, and discards/revokes at
teardown. Never put the token in argv, task file, evidence or Hub detail.

## KeyCape adapter and token delivery

```task
id: GLAS-WP-0018-T04
status: wait
priority: medium
```

Blocked on key-cape (agent-token issuance, `act`, revocation) and the sand-boxer
or credential owner (delivery route). Agree the `actor` (`adm`/`agt`/`atm`) to
IAM principal_type mapping with net-kingdom. Rein presentation of the token is a
rein-aharness task.

## Per-action attribution and durable evidence

```task
id: GLAS-WP-0018-T05
status: todo
priority: medium
```

Emit an ActionRecord per observed commit and streamed tool event, with
completeness stated. Require and verify `Assistant`, `Assistant-Session`,
`Assistant-Process` trailers on sandbox commits. Add a durable local outbox for
Hub reports. Receipt stored outside the sandbox; independent verification
step defined with net-kingdom (SI-15 verify).

## Interactive-session contract and Codex/Grok feasibility

```task
id: GLAS-WP-0018-T06
status: todo
priority: low
```

Publish a provider-neutral session identity contract for sessions Glas does not
launch. Check what hooks Codex and Grok offer; decide whether a rein for either
is worth building. Record that interactive sessions remain at SI-14 "person's
reach" until then.