Authorize
Atlas
Replaces the shared API key an AI agent uses with a scoped, attenuable token bound to its workload identity — verified offline, with no network hop on the authorization path.
Narrow it. Then try to widen it.
An agent holding a token can hand a weaker one to the next hop without asking anyone. What it cannot do — at all, by construction rather than by policy — is hand out a stronger one. Four clicks to see why that matters.
- subject
- spiffe://rajpatil.dev/ns/payments/sa/aisre-agent
- effective
- k8s:* · everywhere · 15m
none — this token can do anything the issuer could
- +ns == payments
- +action == restart
- +resource == checkout-api
- +exp <= now + 60s
Why not just use an API key
The default way to let an agent call a tool is to give it a key. That key is bearer-authority: whoever holds it has everything it can do, for as long as it lives, from anywhere. When the agent passes work to a sub-agent it passes the whole key, because a key has no smaller version of itself.
Workload identity fixes who the caller is; SPIRE issues an SVID that says this process, on this node, in this namespace. Capabilities fix what it may do. Atlas joins the two: the token names the workload it was minted for, and a verifier checks both without calling anything — which matters, because an authorization check on the network path is a dependency that fails during exactly the incidents you built the agent to handle.
What is actually interesting about it
- Each delegation token is bound to a SPIFFE workload identity issued by SPIRE, and verified fully offline — authorization adds no network round-trip.
- Tokens are attenuable: a caller can narrow a capability it holds before passing it on, but never widen it.
- Passed a 28-vector conformance suite, 18 of them adversarial — replay, scope escalation, clock skew, stale trust bundle.
- That suite exists because an audit found 12 deployment-phase defects that a fully passing unit-test suite had hidden. Unit tests proved the logic; nothing proved the deployment.
- Two of those were the interesting kind: a signature time-unit defect (seconds compared against nanoseconds) and a trust-bundle refresh failure that silently rejected all traffic. Hardened with fail-closed revocation on short-TTL refresh.
- Ships an MCP server plus SDKs in Go, Python and TypeScript. Deployed live, and now enforces least privilege on every tool call inside AISRE.
Scope — what this is not
A working service with a conformance suite and three SDKs, deployed and in use by my own agent pipeline. It has not been through an external security audit or run in production at another organisation.
Elsewhere in the system
An agentic incident-response pipeline: it detects a live service failure, investigates it with a three-tool orchestrator, and proposes a root cause — but cannot touch anything until a human approves.
A Kubernetes benchmark that measures whether an LLM actually read the cluster evidence before diagnosing an incident — or just guessed confidently from metadata.
Terraform tells you what drifted. This tells you who changed it, when, and from where — by correlating the plan against CloudTrail.