Nested · 06 of 10 · Agent identity

Agents are identities: each ring narrows the blast radius

Authority only narrows as it moves inward. The unit an agent actually holds is one token, for one verb, on one resource, and that is also the unit that gets audited.

Agents are identities: each ring narrows the blast radius Nested containment from organization guardrails through a team, an environment and an agent session down to a single tool call, where each ring narrows what an agent identity can reach. L1 · ORGANIZATIONOrganization guardrailsorg policies · admission policy · audit retentionL2 · TEAMTeam: checkoutown accounts · own policy set · no cross-team reachL3 · ENVIRONMENTEnvironment: checkout-devnamespace RBAC · quota · network segmentationL4 · AGENT SESSIONAgent sessionidentity TTL 30 min · task-scoped role · token budgetOne tool callone short-lived token · one verb · one resource · one audit rowA compromised agent reaches exactly what its session was scoped to, and nothing that belongs to another team.LEGENDUnit of authorityScope ring (each narrower than the last)

Problem

Agents are identities. They need scoped credentials, bounded blast radius, and audit trails that hold up in front of a regulator.

Design choices

  • Workload identity first (IRSA on EKS or its Azure and Google equivalents); secrets only where federation cannot reach.
  • Dynamic, short-lived database credentials delivered by External Secrets.
  • Cross-team reach is denied by policy, not by convention.

Evidence and gap

Built in Hangar: provider-infisical with declarative, Delete-protected projects adopted in place, ESO delivery, and a standing preference for never-persisted credentials. Gap: cloud workload identity was not exercised in Hangar.

Hangar · reference architecture