tegwick
b386b796e3
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 328925@bnt-lap001 Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
3.1 KiB
| id | type | title | domain | repo | status | flavor | owner | topic_slug | created | updated |
|---|---|---|---|---|---|---|---|---|---|---|
| GLAS-WP-0018 | workplan | Session-scoped agent identity, attribution and tool boundary | infotech | glas-harness | proposed | implementation | claude | session-agent-identity-tool-boundary | 2026-10-24 | 2026-10-24 |
Session-scoped agent identity, attribution and tool boundary
Request: net-kingdom message 14ea093a (service-identity-privilege_v0.1 draft-3,
SI-14, SI-15; SEC-DSM DSM-AGENT-002, -007, -008). Assessment:
history/2026-10-24-agent-session-identity-and-tool-boundary-assessment.md.
Status is proposed: needs founder approval and key-cape / sand-boxer replies
before T04. T01 to T03 have no external dependency. No harness behavior has been
changed by drafting this plan.
Contract fields and evidence
id: GLAS-WP-0018-T01
status: todo
priority: high
Add optional identity_ref (subject, act.sub, jti, issuer, expiry; never the
token), session_id and on_behalf_of to the request and ExecutionEvidence.
Add hashed evidence-receipt location and sha256. Tests; backwards compatible.
Boundary declaration and tool-profile echo check
id: GLAS-WP-0018-T02
status: todo
priority: high
Add a profile boundary block, record it in evidence, and fail the run when the
rein reports a tool profile different from the requested one. Catalog validation:
profiles with credential routes or an identity requirement must name a
non-default tool profile. Request rein-aharness to export its tool-profile
manifest.
Issuer interface and fail-closed path
id: GLAS-WP-0018-T03
status: todo
priority: medium
Define AgentIdentityIssuer with a test double. Gateway obtains a per-run token
(ttl = min(profile, remaining timeout, 3600)), fails closed with a new
identity failure stage, redacts the token pattern, and discards/revokes at
teardown. Never put the token in argv, task file, evidence or Hub detail.
KeyCape adapter and token delivery
id: GLAS-WP-0018-T04
status: wait
priority: medium
Blocked on key-cape (agent-token issuance, act, revocation) and the sand-boxer
or credential owner (delivery route). Agree the actor (adm/agt/atm) to
IAM principal_type mapping with net-kingdom. Rein presentation of the token is a
rein-aharness task.
Per-action attribution and durable evidence
id: GLAS-WP-0018-T05
status: todo
priority: medium
Emit an ActionRecord per observed commit and streamed tool event, with
completeness stated. Require and verify Assistant, Assistant-Session,
Assistant-Process trailers on sandbox commits. Add a durable local outbox for
Hub reports. Receipt stored outside the sandbox; independent verification
step defined with net-kingdom (SI-15 verify).
Interactive-session contract and Codex/Grok feasibility
id: GLAS-WP-0018-T06
status: todo
priority: low
Publish a provider-neutral session identity contract for sessions Glas does not launch. Check what hooks Codex and Grok offer; decide whether a rein for either is worth building. Record that interactive sessions remain at SI-14 "person's reach" until then.