Secure paved road · 03 of 19 · The write path

The durable path: an agent's write is a git write

This is the spine for anything that outlives a run. Agents hold no cluster credential. They propose changes as pull requests, ArgoCD pulls what has been merged, and the one imperative action, syncing a lower environment, is delegated to ArgoCD under its own narrow account. Ephemeral runs are the other plane.

The durable path: an agent's write is a git write Architecture with three trust zones showing that an agent reaches Clearance over MCP, Clearance mints a repo-scoped token through the token-review-interceptor, opens pull requests on GitHub behind branch protection, and may only sync lower environments in ArgoCD, while direct upper-environment sync and direct cluster writes are denied at the boundary. UNTRUSTEDPRIVILEGEDDELIVERYDIRECT SYNC OF AN UPPER ENV · DENIEDKUBECTL OR APISERVER WRITE · DENIEDMCPSYNCPRMINTPULLPULL AFTER HUMAN MERGEAgentany frameworkClearanceMCP · CEL · audittoken-review-interceptorapp key stays hereArgoCD · lowerAppProject *-lowerGitHub reposbranch protection + checksArgoCD · upperhuman merge onlyAgents can propose to upper environments. Only a human merge lets ArgoCD pull the change.LEGENDPrivileged gateCredential mintGoverned callDelegated, lower onlyDenied route

Principle honored

Delegated over interactive: call an API that already holds write authority and already audits itself (Tower write-action policy). No pod exec, ever; lower-only for any write RBAC; authz required before prod.

What changes

  • New ArgoCD account role:clearance-lower, sync on *-lower/* projects only (Tower's role:tower-sync today is */*).
  • Clearance never holds the GitHub App key; the interceptor does, as it already does for Backstage.
  • A separate GitHub App for agents, so agent traffic cannot starve CI release PRs of API budget.

Verify live

Prove the two denials, not just the happy path: with the agent's token, an upper-project sync must return 403, and a kubectl write must be refused by the apiserver. A passing happy path can mean a gate is off.

Hangar · Autopilot