Sequence · 11 of 19 · Identity and credentials

One call, end to end: identity in, scoped token out, nothing kept

The agent never sees a GitHub token. Clearance derives who is acting from Tower's login, decides in CEL, and gets a token scoped to one repository for that one call. The audit id in the reply is the record the rest of the platform correlates on.

One call, end to end: identity in, scoped token out, nothing kept Sequence diagram of a delegated agent opening a session, Clearance validating the human through Tower auth, evaluating a CEL policy, then either denying with a rule id or asking the token-review-interceptor for a repo-scoped GitHub token, making a signed commit and pull request, and returning the pull request URL with an audit id. ALT[policy denies][policy allows]SESSION.OPEN · OAUTH TOKENINTROSPECT TOKENUSER + GROUPSCALL: PR.OPEN(REPO, BRANCH)CEL: profile, user rights, tier ceilingDENIED · RULE IDMINT(REPO, PERMS) · SA TOKENREPO-SCOPED TOKENSIGNED COMMIT · OPEN PRPR + CHECKS QUEUEDPR URL + AUDIT IDAgentdelegated by a humanClearancesession · policy · auditTower authBackstage OAuthInterceptorTokenReview + app keyGitHubApp installationLEGENDCallReturnHeadline successPolicy gateCredential mint

Principle honored

Never-persisted credentials: mint per call, not cache and refresh. Isolation comes from the TokenReview answer, never from a claim in the request body.

What changes

  • New interceptor route beside /github-installation-token: it checks the caller is Clearance and the repo is in the session's profile.
  • Workload agents (Holmes, Preflight) authenticate with a projected service-account token, audience clearance.
  • Open decision: commits must satisfy the provenance gate. Sign with the self-hosted Fulcio (workload trust root) and extend the gate, or exempt agent PRs. Prefer the first.

Verify live

Add a test that forges a session id in the request body and confirms the decision still comes from the TokenReview namespace, as ADR-0002 does for CDEvents.

Hangar · Autopilot