docs: design credential bindings for agent copies (#1873) #1923

2026-11-11T06:01:36Z

jason.woltje commented

2026-11-11 06:01:36 +00:00

Design for credential binding on agent copies (#1873). Doc only, proposed, for Jason's approval before any build.

A3 (#1917) made root and project agents into per-org copies, and a copy whose role needs a credential (gitea, vikunja, the six creative thread roles) can't launch. This doc proposes how an owner binds a credential to one copy in one org.

Storage: an org-local copyBindings overlay in the organization file, written by the guarded organization writer under its revision fence. It names a slot from today's per-agent store, never a secret value. Copy definitions stay secret-free.
Authority: bind and unbind are authority-change decisions on the hire model (op: "change"), entered through the existing org.hire right, with an extra owner-only check at resolve and at commit. No new right. No agent binds for itself or another agent.
Ceiling: a binding grants at most what the frozen role declares, narrowed by the org, checked at bind, at admission and on each use. A service without a verifier stays refused.
Lifecycle and two-org isolation: unbind, revoke, slot removal, role change, fire, archive and delete each close admissions and deny later calls; one org's slot never serves another org's copy.
Slices CB0-CB5, after T1 and A4, each with acceptance tests, ending with the two-org thread-copy test A3 deferred. Section 8 lists which slices touch schema or the credential boundary.
Section 9 holds three questions for Jason.

Changes no code, right, role, contract, secret or running instance.

Lane: Sol, base 6415e81ee. Security review daybreak-blue: approve, no findings.

Design for credential binding on agent copies (#1873). Doc only, proposed, for Jason's approval before any build. A3 (#1917) made root and project agents into per-org copies, and a copy whose role needs a credential (gitea, vikunja, the six creative thread roles) can't launch. This doc proposes how an owner binds a credential to one copy in one org. - Storage: an org-local `copyBindings` overlay in the organization file, written by the guarded organization writer under its revision fence. It names a slot from today's per-agent store, never a secret value. Copy definitions stay secret-free. - Authority: bind and unbind are authority-change decisions on the hire model (`op: "change"`), entered through the existing `org.hire` right, with an extra owner-only check at resolve and at commit. No new right. No agent binds for itself or another agent. - Ceiling: a binding grants at most what the frozen role declares, narrowed by the org, checked at bind, at admission and on each use. A service without a verifier stays refused. - Lifecycle and two-org isolation: unbind, revoke, slot removal, role change, fire, archive and delete each close admissions and deny later calls; one org's slot never serves another org's copy. - Slices CB0-CB5, after T1 and A4, each with acceptance tests, ending with the two-org thread-copy test A3 deferred. Section 8 lists which slices touch schema or the credential boundary. - Section 9 holds three questions for Jason. Changes no code, right, role, contract, secret or running instance. Lane: Sol, base 6415e81ee. Security review daybreak-blue: approve, no findings.

jason.woltje added 1 commit 2026-11-11 06:01:36 +00:00

docs: design credential bindings for agent copies 85858938fc

jason.woltje merged commit 85858938fc into refactor

2026-11-11 06:01:42 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1923