## The problem it solves

The two identity planes used to be disjoint. **Operators** authenticate with an
OIDC bearer and act through grants. **Agents** are attested workloads with a
mediated existence: arbitrary, untrusted code that never holds a secret and
never talks to the controlplane. That left a real workflow locked out — an
auditor *agent*, running next to the work it audits, could not read the audit
trail it is a subject of. Bridging the planes naively (a standing credential in
the agent, an agent dialing the controlplane) would break the two invariants the
whole system is built on.

## The shape

The agent still holds nothing, and its egress is still totally mediated:

1. The agent's connection toward the operator API is **terminated at the enclave
   gateway**, exactly like every other egress — it never reaches the
   controlplane directly.
2. The gateway relays the agent's **attested identity** (the certificate half of
   its per-agent credential; the key never leaves the trusted plane) through the
   enclave broker, which refuses the relay for an unknown or contained agent
   *before* the controlplane is consulted.
3. The controlplane verifies the identity against the enclave's pinned roots and
   mints a **60-second, audience-scoped token** under its own signing key —
   serving its public keys at a standard OIDC discovery + JWKS endpoint.
4. The gateway caches the token per-agent (never longer than its life, dropped
   on any failure) and **presents the bearer itself** on the re-originated hop.

So the credential exists only inside the trusted plane, for a minute at a time,
and pod death simply stops its presentation. The agent's own view never
changes: a socket, mediated egress, no secrets.

## The blast radius

Authorization for this caller class is deliberately minimal, and enforced
structurally rather than by convention:

- Agents are a distinct principal **kind** — an agent token can never be read as
  a human operator, and the kind comes from which authenticator accepted the
  token, not from any claim a caller could forge.
- An org admin grants an `agent:<uid>` principal the **auditor** role —
  org-scoped, validated against the grant's own org, nothing wider exists to
  grant.
- A kind condition on every capability-gated route refuses the agent kind
  *before* grants are even loaded — so even a mistakenly over-granted agent
  reaches exactly one surface: **reading its own audit records**.
- Containment works by mediation, not by waiting for expiry: the mint is
  refused, the gateway drops the token, and the residual is bounded by the
  60-second lifetime.

Every action lands in the audit stream with the actor (`agent:<uid>`) and a
first-class actor-kind field, so a human operator reading the same trail can
always tell agent actions from human ones.

## Where it goes next

The same token class is a standard OIDC issuer, so it can federate into a cloud
provider's workload identity federation — attestation claims (org, tier, image
digest) mapped to a cloud role condition — without a standing cloud credential.
That direction is proven for GCP and documented in
[Workload identity federation](/reference/workload-identity-federation).
Cross-enclave agent trust (enclave B trusting enclave A's agents) is
deliberately not built; the token design leaves room for it.