Identity & Security
Mandrel mandates a Compound Identity model to eliminate the risk of agents performing unauthorized actions.
This page describes the intended identity architecture. Several parts are specified and not yet built, and the table below says which. It is here rather than in a footnote because a security architecture that reads as though it is finished is worse than one that is honestly incomplete — an operator planning against this page needs to know what the enforcement engine actually checks today.
| Control | Status |
|---|---|
| Machine identity presented per request | Implemented, but self-asserted — the value is read from the request body, not from a verified certificate |
| Ingress allow-list matching | Implemented, segment-aligned |
| mTLS transport | Not implemented. Until it is, the machine badge is a claim rather than an identity |
| Nested JWT signature verification | Not implemented. Required scopes are matched against the token string |
| RFC 8693 actor-chain walk | Not implemented |
| DPoP (RFC 9449) | Not implemented. enforce-dpop is parsed and defaults to true |
| Step-up / HITL token verification | Partially implemented. The gate fires; the token is not cryptographically verified |
| CAE revocation (RFC 8936) | Not implemented |
| Realized Spec signature | Specified and implemented in the SDK; not yet verified at spec load by the Collet |
The “Double Badge” Model
Every Agent-to-Agent (A2A) request must present two distinct context badges:
- Machine Context (SPIFFE): Verifies the workload identity via mTLS.
- Human Context (Nested JWT): Verifies the user intent and authorization chain.
These are evaluated by The Collet (Sidecar) using Open Policy Agent (OPA) to ensure the request satisfies the Mandrel Spec.
Protocol Alignments
Chain of Custody (RFC 8693)
As requests traverse the mesh, The Collet prevents “Identity Wash.” It exchanges the user’s token for a delegated token containing the act (Actor) claim, ensuring a full audit trail: “User A, delegated through Orchestrator B, executed by Specialist C.”
Sender-Constrained Tokens (DPoP)
To prevent replay attacks, the architecture mandates RFC 9449 (DPoP). Tokens are mathematically bound to the agent’s SPIFFE private key.
Step-Up Authentication (HITL)
High-risk actions defined in the enforcement-matrices utilize RFC 9470 OAuth 2.0 Step-Up Authentication. If a threshold is crossed, the Collet triggers a challenge, requiring explicit user cryptographic proof before the tool execution is unlocked.
The approval token is specified to carry a three-point check: a JWS from a trusted issuer, a
turn_id binding it to the current transaction, and an aud naming the target agent. The
preferred issuer is the operator’s own identity provider — humans already authenticate there,
and Keycloak, Okta, Entra and Ping all support acr_values. A metrology lab is the fallback
for deployments whose IdP cannot perform step-up.
One design gap is worth naming, because it is not obvious: binding approval to a turn_id
alone means an approval obtained for a $5,000 transfer would authorize a $500,000 one later in
the same turn. The token needs to commit to the governed attribute and its value, which the
challenge can carry in the standard OIDC nonce — every provider round-trips it unmodified,
and it exists precisely as a binding channel.
Real-Time Revocation (CAE)
The mesh subscribes to Continuous Access Evaluation (RFC 8936). If a revocation event is issued, The Collet instantly terminates all active tool access and gRPC streams.
Signing and verification
How a Realized Spec is signed and checked — placement, coverage, the claim set, and the rule that the algorithm comes from the resolved key rather than the token — is specified in the metrology contract.