Agent as operator

The problem it solves

The two identity planes used to be disjoint. Operators authenticate with an OIDC bearer and act through grants. Agents are attested workloads with a mediated existence: arbitrary, untrusted code that never holds a secret and never talks to the controlplane. That left a real workflow locked out — an auditor agent, running next to the work it audits, could not read the audit trail it is a subject of. Bridging the planes naively (a standing credential in the agent, an agent dialing the controlplane) would break the two invariants the whole system is built on.

The shape

The agent still holds nothing, and its egress is still totally mediated:

1. The agent’s connection toward the operator API is terminated at the enclave gateway, exactly like every other egress — it never reaches the controlplane directly.
2. The gateway relays the agent’s attested identity (the certificate half of its per-agent credential; the key never leaves the trusted plane) through the enclave broker, which refuses the relay for an unknown or contained agent before the controlplane is consulted.
3. The controlplane verifies the identity against the enclave’s pinned roots and mints a 60-second, audience-scoped token under its own signing key — serving its public keys at a standard OIDC discovery + JWKS endpoint.
4. The gateway caches the token per-agent (never longer than its life, dropped on any failure) and presents the bearer itself on the re-originated hop.

So the credential exists only inside the trusted plane, for a minute at a time, and pod death simply stops its presentation. The agent’s own view never changes: a socket, mediated egress, no secrets.

The blast radius

Authorization for this caller class is deliberately minimal, and enforced structurally rather than by convention:

• Agents are a distinct principal kind — an agent token can never be read as a human operator, and the kind comes from which authenticator accepted the token, not from any claim a caller could forge.
• An org admin grants an agent:<uid> principal the auditor role — org-scoped, validated against the grant’s own org, nothing wider exists to grant.
• A kind condition on every capability-gated route refuses the agent kind before grants are even loaded — so even a mistakenly over-granted agent reaches exactly one surface: reading its own audit records.
• Containment works by mediation, not by waiting for expiry: the mint is refused, the gateway drops the token, and the residual is bounded by the 60-second lifetime.

Every action lands in the audit stream with the actor (agent:<uid>) and a first-class actor-kind field, so a human operator reading the same trail can always tell agent actions from human ones.

Where it goes next

The same token class is a standard OIDC issuer, so it can federate into a cloud provider’s workload identity federation — attestation claims (org, tier, image digest) mapped to a cloud role condition — without a standing cloud credential. That direction is proven for GCP and documented in Workload identity federation. Cross-enclave agent trust (enclave B trusting enclave A’s agents) is deliberately not built; the token design leaves room for it.