Auth Broker

Every agent pattern we have delivered this year runs under a service account with a role wide enough to finish the task, which means wide enough to do damage. The identity vendors noticed in Q2 and two of them shipped 'agent identity' previews in August; an IETF draft for on-behalf-of token exchange is the shape they are converging on. Our own proof of concept put a policy engine at the tool-call boundary and blocked over-privileged calls at under 15 ms overhead. The hard part turned out to be writing the policies, not evaluating them, and nobody on a delivery team is staffed to do it.

Banking and government clients now ask, in the first workshop, whose credentials the agent is using when it acts. We have not had a good answer. APRA is treating agents as non-human identities under CPS 234 rather than writing new rules, which makes audit trail the binding requirement on every agent we put near a payment or a customer record. A reusable broker pattern is the difference between agent work in regulated sectors and agent demos in regulated sectors.

Agents that call tools on behalf of a person need delegated, scoped, expiring authority that names the principal, the agent and the task; OAuth scopes cannot express that triple, so every agent we ship into a regulated client needs a broker in front of its tool calls. That is the lab's one-line position on it, which is not the same as an explanation.

The shape the field is converging on, from the most authoritative source in it: Regulators will fold agents into existing identity controls rather than write new rules.signal

This is the section a page most needs a person for, and the one composition is worst at. Nobody has written the plain-language version — what the idea is, in words that assume nothing — and it is the first thing a reader who has never met the term needs.

Nobody has to be convinced this matters, which is unusual and is the reason to move. It is the first question in the first workshop, from the client's side, unprompted. And APRA treating agents as non-human identities under CPS 234 rather than writing new rules means the requirement arrives through a framework banks already run against — the cheapest kind of adoption, because the client's own auditors already know how to test it.signalsignal

The window is what makes it urgent rather than important. Two identity vendors shipped previews in August and an IETF draft is the shape they are converging on, so a bespoke broker has a life measured in quarters. The honest read is that this is worth doing now precisely because it is temporary: the firm that can operate the pattern in production this year is the one deciding how to turn the vendor feature on next year, and that is a better position than having built the feature.

Today an agent that acts on a customer's behalf borrows a service account. That account has a role wide enough to finish any task it might be asked to do, which means wide enough to do damage on the one task it was actually asked to do. Nothing in the request says which customer, which case, or which human wanted it — so nothing downstream can refuse a request that is technically permitted and obviously wrong.signalsignal

A broker changes the shape of the request rather than the model. Between the agent and the tool it issues a short-lived token naming three things: the principal the work is for, the agent doing it, and the task it was scoped to. Every downstream system keeps its existing authorisation, and gains a request it can reason about. The audit trail stops being a log of what a service account did and becomes a record of what was done for whom, on whose instruction.

The practical consequence for a delivery team is smaller than it sounds and lands in a different place than expected. The engineering is a sidecar and a token exchange. The work is writing the policies — deciding what 'scoped to this task' means for a refund, a limit change, a hardship arrangement — and that is a conversation with the business, not a build.

The binding constraint is reliability: it works and is not yet dependable enough to put near a customer. Everything upstream of that is solved and everything downstream of it is waiting.

Workforce readiness is low: No delivery team has written a tool-call policy. Agent-estimated. A recommendation needing skills the firm does not hold is an aspiration rather than an action, and it routes to the enablement agenda instead of the delivery one.

Something here has already been killed: Plain OAuth scopes are enough for agent delegation, on no test tenant was made available in the run window, so the claim that native identity-provider scopes can express per-task agent delegation was never exercised against a real directory. It is marked resurrectable on: A sandbox tenant on Entra ID or Okta with the firm's actual scope definitions and permission to mint tokens against synthetic customer records..graveyard

The argued case against it is the red team's, further down this page, and it is deliberately one-sided — this section is what stands in the way mechanically, not what somebody thinks of it.