Nested · 06 of 10 · Agent identity

Agents are identities: each ring narrows the blast radius

Authority only narrows as it moves inward. The unit an agent actually holds is one token, for one verb, on one resource, and that is also the unit that gets audited.

Agents are identities: each ring narrows the blast radius Nested containment from organization guardrails through a business line, an environment and an agent session down to a single tool call, where each ring narrows what an agent identity can reach. L1 · ORGANIZATIONOrganization guardrailsSCPs · admission policy · audit retentionL2 · BUSINESS LINEBusiness line: lending (Mogo)own accounts · own policy set · no cross-line reachL3 · ENVIRONMENTEnvironment: lending-devnamespace RBAC · quota · network segmentationL4 · AGENT SESSIONAgent sessionidentity TTL 30 min · task-scoped role · token budgetOne tool callone short-lived token · one verb · one resource · one audit rowA compromised agent reaches exactly what its session was scoped to, and nothing in another business line.LEGENDUnit of authorityScope ring (each narrower than the last)

Requirement

Agents are identities. They need scoped credentials, bounded blast radius, and audit trails that hold up across lending, payments, and securities regulation.

Design choices

  • Workload identity first (IRSA on EKS, the OCI equivalent); secrets only where federation cannot reach.
  • Dynamic, short-lived database credentials delivered by External Secrets.
  • Cross-line reach is denied by policy, not by convention.

Evidence and gap

Built in Hangar: provider-infisical with declarative, Delete-protected projects adopted in place, ESO delivery, and a standing preference for never-persisted credentials. Honest gap: IRSA and the OCI equivalent were not exercised in Hangar.

Hangar · reference architecture