tegwick
7190f5dfb7
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 328925@bnt-lap001 Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
2.7 KiB
| id | type | title | domain | repo | status | owner | topic_slug | created | updated | flavor | depends_on | state_hub_workstream_id |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| KEY-WP-0043 | workplan | Issue short-lived per-run agent tokens (autonomous and delegated) | infotech | key-cape | proposed | claude-code | custodian | 2026-10-24 | 2026-10-24 | extension | b6b58a0b-cf75-5fd6-9545-96f37da0cc90 |
Proposed from docs/proposals/2026-10-24-per-run-agent-identity-assessment.md (verdict: feasible with changes). Serves SEC-DSM DSM-AGENT-002/003 and SI-14 of net-kingdom's Service Identity and Privilege standard. Proposal only: no task starts before owner agreement, and nothing here deploys or registers a client live; registration and rollout stay NetKingdom/Railiance-gated.
Agree the agent claim shape and mechanism
id: KEY-WP-0043-T01
status: todo
priority: high
state_hub_task_id: "cb2d7cf1-7989-5e93-a711-c843ea56f666"
With net-kingdom, glas-harness, flex-auth and railiance-platform: fix agent
(id, mode, class, run_id), act.sub/actor_sub, nested delegated
assurance, boundary-policy reference, the 15-minute default and 3600 s cap, and
the launcher-holds-the-credential model. Output: an IAM Profile amendment note.
Autonomous agent tokens via client_credentials
id: KEY-WP-0043-T02
status: wait
priority: high
state_hub_task_id: "4fc0ea89-0a0b-5310-b7dd-00c4dfaf2175"
Add principal_type: agent as a literal on its own path, agent client class
registration with validation (confidential, env secretRef, tenant, mode,
cap at most 1h), validated run_id request parameter, assurance for the
agent credential, deliberate update of the principal-type guard test,
discovery and token-status/verifier support. Tests: claims, cap, refusals.
Depends on T01.
Delegated agent tokens via token exchange
id: KEY-WP-0043-T03
status: wait
priority: high
state_hub_task_id: "7d2ee7e1-0b5a-5aad-b917-fd6807a1c112"
Implement RFC 8693 exchange: authenticate the agent client, verify the human
subject token (signature, status, suspension, human type, minimum assurance),
tenant equality, scope intersection, act.sub, nested assurance, expiry at
most the subject expiry and the cap. Negative tests: agent or service subject
token, tenant mismatch, expired or revoked subject, scope widening. Depends on T02.
Consumer coordination and rollout packet
id: KEY-WP-0043-T04
status: wait
priority: medium
state_hub_task_id: "d6645702-3bee-5ea2-b2e2-ec3e406a3a81"
Hand OpenBao role bindings (including nested-claim bindability) to railiance-platform, agent authorization input to flex-auth, and the launcher flow to glas-harness. Prepare a registration and rollout packet for NetKingdom; perform no live change.