Agent identity and policy planes

Identity first: a minted principal that plugs into the identity management already in place, so attribution is honest, a compromised agent’s reach is bounded, and access reviews and kill switches keep working on it. Registry second: a listing of which agents exist, closer to a directory service than to a config file. Gateway third: one interception point between agents and the world, deciding allow, deny or ask-a-human with awareness of the whole session rather than a single action, and a narrow declared output channel on the far side — permitted, for instance, to create exactly one issue and nothing else.

Because agents discover tools at runtime, static role grants are the wrong granularity. The sharper designs derive a scoped credential before each tool call — a token exchange for a narrower token — so agents never receive blanket permissions: just-for-task, just-in-time. There is an unsolved corner underneath, the mismatch created when an agent built by a low-access user is shared with a high-access colleague: deny-by-default breaks the agent, and allow inherits too much.

Identity governance is largely solved; intent governance is not. The newest layer captures the agent’s intended action sequence and matches it against policy before execution — told to summarize one document, an agent reading a different one, writing instead of reading, or wandering into another system is blocked as outside intent. Governance is then defined as the ability to act on what observability shows: record declared authority, diff it against observed behaviour, classify the variance, and hold an engineered containment path. Drift is not automatically bad; the point is knowing the delta, with control failure — not anomaly count — as the headline number. A separate hazard is named repeatedly: sub-agents inheriting a parent’s privileges “should not be happening” and is the default.

Also: GitHub Agentic Workflows; Google’s agent development kit and its agent-to-agent and commerce protocols; OPA; Envoy; a Rust policy proxy; workflow-automation and observability tooling used as the governance surface.

Per-role applications give each desk role its own principal, minted per session and short-lived; a role roster is the registry; every filing carries honest raised-by attribution; branch protection is the kill switch. The confession described above — agent work merged under a human’s name and signature — is precisely the failure this design rules out rather than mitigates. The narrow verb set is the task-aware permission layer, and the “safe outputs” framing is a sharper name for the same idea. See desk roles.

Governance today is convention plus server-side forge gates. There is no one place observing every tool interaction across desks, so a proxy-level policy plane is the defense-in-depth layer that would survive a desk going wrong or being injected mid-session. Per-task credential narrowing does not exist either: tokens are role-scoped, not brief-scoped, which is the gap against just-for-task derivation. Output budgets are not declared data — each role could state “may file issues; may not push code” in a form a lint could check, rather than leaving it to prose. A stuck-in-a-loop policy detector, which one source ships, is exactly what Assay’s own runaway-dispatch incident showed is absent. And the privilege-mismatch problem is live for a published methodology bundle: skills should declare the privilege assumptions they were written under.

Assay implements more of the runtime trust plane than it names. Signed intent is the brief plus its durable dispatch claim. Declared-versus-observed is the gap between a role’s narrow verbs and what its commits actually touch, which path guards enforce mechanically. The kill switch is the rule that a blocked push is a stop, never a prompt to route around. The sharpening the evidence offers is a measurement one: guard violations and overrides should be the primary trust signal rather than activity volume. The generated board and the daily reports measure visibility, not control — observability is not governance. Rollback is the thinnest layer in the design.

• Whether brief-scoped or task-scoped credential derivation appears in any off-the-shelf agent platform, which would make per-task narrowing cheap to adopt.
• Whether intent governance — plan captured and diffed against policy before execution — converges on a shared protocol, or stays per-vendor.
• Whether declared-versus-observed variance reporting becomes a standard artifact. That is the metric needed to make guard violations, rather than throughput, the headline trust number.