The agent permissions model

An agent authenticates with a bearer token, and any process holding that string is the agent. There is no cryptographic binding to a workload in most deployments — Token Observe carries that as a stated residual risk rather than hiding it — which makes the permission set the load-bearing control. Whatever the token can reach is whatever the roles name.

So name actions. The resource being authorised should be a string that identifies one callable thing: a model by name, or a tool by server and tool name. One vocabulary covering both surfaces is worth more than two, because it lets a single line scope an entire tool server or a model family, and because it means a reviewer reading a role sees one kind of thing rather than two.

The reason to resist system-level roles is that they are the source of almost every over-grant. A role called order-management sounds like a description of a job and is actually a description of an API surface, and API surfaces contain the dangerous endpoint next to the harmless one because that is how APIs are organised. An agent that needs to look up an order does not need to refund it, and the only way to express that is to name both.

Keep the matching dull. A resource pattern should be a literal string in which a wildcard matches any run of characters, with every other regular-expression metacharacter escaped before the pattern compiles — so an operator who types a full stop into a tool name gets a full stop rather than an accidental wildcard, and a grant on one tool does not match a differently-punctuated neighbour. Clever matching in a permission language is a bug that reads as a policy decision.

When one agent hands work to another, the effective permission set for that request has to be the intersection of every agent in the chain: every hop must allow the action independently, and the request is refused at the first hop that does not.

The alternative — taking the union, or simply authorising as the final agent — is a privilege escalation with an audit trail that looks entirely legitimate. A low-privileged agent refused a refund asks the payments agent to do it, and the payments agent holds the grant. Nobody attacked anything. The escalation is the architecture, and it will be discovered the first time an injected instruction in a ticket body finds it.

Intersection is inconvenient by design, and it is worth being explicit about the inconvenience because it is the objection you will get. An orders agent and a payments agent that delegate to each other can jointly do nothing: not the order lookup, because the payments agent lacks it, and not the refund, because the orders agent lacks it. The failure mode of an intersection is under-privilege, which surfaces as a support ticket somebody investigates. The failure mode of a union is an escalation nobody notices.

The reason intersection is also the safe response to an untrusted chain is the part worth internalising. A delegation chain generally arrives as a request header and is asserted rather than proven: it is only as trustworthy as the calling agent’s own authentication. Under intersection semantics a forged chain can only add links, and every added link must also allow — so an attacker who forges the header buys strictly less than one who sends none. Under union semantics, forging the header is the attack.

Fail closed on a hop you cannot resolve. A chain naming an agent the registry does not know, or one that is not currently active, should refuse rather than skip the link; on a tool path an unresolvable hop can contribute an empty role set and deny through the ordinary intersection. Bound the chain length as well — Token Observe truncates at eight hops on the tool gateway and accepts at most 32 identifiers on the model gateway — because an unbounded header is an unbounded amount of work per request.

Permissions are standing grants. They stand until somebody edits the role, nothing expires on its own, and agent credentials are long-lived bearer tokens rotated by hand. That is the standing-privilege pattern security handbooks warn about, and the honest position is that the controls here are for noticing accumulation rather than for preventing it.

Access recertification is the noticing mechanism, and it only works if it binds the right thing. A review recording that agent X holds role Y certifies almost nothing, because role Y is editable afterwards and the review does not say what was in it — six months later a named reviewer’s attestation sits beside a permission set they never saw, and nothing in the record distinguishes that from a genuine review. Bind the digest instead: each referenced role’s name, its permission count and a hash over its normalised permissions. Editing a role then makes every affected review stale immediately, without rewriting the history of what was actually attested.

Normalise ordering where ordering grants no different authority — de-duplicate and sort role ids, tags and actions before hashing — so that harmless reordering does not manufacture staleness. A staleness signal that fires on cosmetic changes trains reviewers to click through, which is the outcome the whole mechanism exists to avoid.

Refuse to delete a role anything still references, and report what still holds it. Deleting a role out from under a running agent is a silent permission change, and silent permission changes are the thing this layer exists to prevent. Write every role creation, edit and deletion into a tamper-evident log with the acting person and the previous permission list beside the new one, so what a role granted last Tuesday has an answer that does not depend on anybody’s memory.

Finally, keep the boundary between permissions and policy sharp. A permission answers whether this agent may touch this tool at all, and that answer has to be readable in one line by somebody attesting to it. A rule such as refunds over £200 need a human reads argument values and belongs in the policy layer. Collapsing the two produces conditional grants that have to be simulated before anyone understands them, and a grant nobody understands is a grant nobody can honestly certify.