type: "Stack layer"
title: "Identity and authorisation"
description: "Establishing who or what is acting, for whom, for what purpose, with which limits."
tags: [stack, identity, authorisation, security]
generated: { by: human:crpage, at: 2026-07-09T09:44:00Z }
status: stable

Role in the stack

The control plane must decide whether, in whose name and under what constraints a tool may be called — the model knowing how to call it is not enough. An agent runtime should almost never hold a single broad ambient credential; it should hold short-lived, narrowly-scoped, audience- and purpose-bound, preferably sender-constrained credentials.

Two questions

OAuth 2.0 (with RFC 9700, token exchange, mTLS-bound tokens, DPoP) answers on whose behalf; SPIFFE/SPIRE workload identity answers what is calling; zero trust removes implicit network trust.

Relates to: Agent-ready, not agent-trusting.

Terms

Glossary terms used here: Workload identity.