Useful start. Keyless identity helps, but runtime authority is the harder test. A valid agent can still be doing the wrong thing for this workflow. I would shape permissions around resource, operation, human context and expiry, so the verifier can tell whether the credential stayed inside its intended bounds.
Spot on, Peter. Identity is just step one, runtime authority is where the real security boundary lives. That's actually why we paired keyless identity with Dynamic RBAC in this setup.
Keyless handles dropping the static secret, while the Dynamic RBAC side continuously evaluates the human context and target resource to issue ultra short-lived, scoped credentials for that specific step in the loop.
That makes sense. The short-lived credential is doing real work because it binds authority to this step, rather than to the agent in general. I would still keep the identity record and the authority record separate: one shows which agent acted, the other why this action was permitted now. When Dynamic RBAC issues the credential, do you preserve the evaluated context and policy version so someone can reconstruct that decision later?
Useful start. Keyless identity helps, but runtime authority is the harder test. A valid agent can still be doing the wrong thing for this workflow. I would shape permissions around resource, operation, human context and expiry, so the verifier can tell whether the credential stayed inside its intended bounds.
Spot on, Peter. Identity is just step one, runtime authority is where the real security boundary lives. That's actually why we paired keyless identity with Dynamic RBAC in this setup.
Keyless handles dropping the static secret, while the Dynamic RBAC side continuously evaluates the human context and target resource to issue ultra short-lived, scoped credentials for that specific step in the loop.
That makes sense. The short-lived credential is doing real work because it binds authority to this step, rather than to the agent in general. I would still keep the identity record and the authority record separate: one shows which agent acted, the other why this action was permitted now. When Dynamic RBAC issues the credential, do you preserve the evaluated context and policy version so someone can reconstruct that decision later?