diff --git a/README.md b/README.md index c48f195..dfbbd58 100644 --- a/README.md +++ b/README.md @@ -19,6 +19,14 @@ provider-verifiable authorization evidence, and execution assurance. Its open conformance work demonstrates interoperability; it is not the product category. See [Project Positioning](docs/positioning.md). +AgentPass also fits into broader task-scoped security architectures such as +Cloudflare's [Agent Access Model (AAM)](https://blog.cloudflare.com/the-agent-access-model/). +AgentPass implements the action-control and evidence layers at the tool and +provider boundary, while integrating with external identity brokers and network +enforcement rather than claiming to replace them. The roadmap tracks a planned +monotonic task capability layer that will remove incompatible authority after +declared protected events and before protected results reach model context. + The runtime decision remains the core enforcement point. The current implementation also includes versioned intent contracts, execution evidence, verified outcome observations, immutable evidence snapshots and final @@ -395,7 +403,8 @@ Near-term work follows three product layers: 1. **Runtime authorization and control:** policy enforcement, approvals, budgets, data-flow controls, idempotency, replay protection, and integrations - at agent, workflow, gateway, and provider boundaries. + at agent, workflow, gateway, and provider boundaries, including planned + monotonic task capability state after protected events. 2. **Portable provider trust and interoperability:** signed action-bound evidence, independent provider verification, contract drift detection, conformance cases, profiles, and multi-implementation demonstrations. diff --git a/docs/action-gate-roadmap.md b/docs/action-gate-roadmap.md index 633fe06..94d5308 100644 --- a/docs/action-gate-roadmap.md +++ b/docs/action-gate-roadmap.md @@ -90,6 +90,22 @@ portable provider trust. Observability supplies operational context for assurance. They advance these layers rather than forming separate product categories. +### Relationship To The Agent Access Model + +Cloudflare's [Agent Access Model (AAM)](https://blog.cloudflare.com/the-agent-access-model/) +is a useful external reference architecture for task-scoped agent security. Its +emphasis on action-level authorization, enforcement outside the model, +short-lived and bounded authority, monotonic capability reduction after +protected events, and directly captured evidence aligns with AgentPass's action +gate and evidence model. + +AgentPass does not claim to implement the complete AAM architecture. Identity +brokering and sender-constrained task credentials remain inputs or integrations, +and network enforcement remains an independent enforcement point. AgentPass +focuses on the task and action boundary: the capability ceiling, exact tool and +data-flow decision, stateful enforcement, provider-verifiable evidence, and +execution and outcome assurance. + ## Roadmap ### Current Status Snapshot @@ -109,6 +125,13 @@ policy at `tools/call` time, preserves process-local job state, blocks duplicate side effects, stops tool thrashing, and denies PII egress before forwarding to a downstream MCP server. +As of 2026-08-10, the next enforcement milestone after the active provider +trust gate is monotonic task capability state and protected-result release. The +tracking program is [#78](https://github.com/dinpd/AgentPass/issues/78). This +work makes the task's capability ceiling explicit, lets declared protected +events remove incompatible tools and destinations, and fences stale work before +protected results reach model context. + The remaining near-term work is less about proving the basic guard pattern and more about hardening the production boundary: @@ -148,7 +171,9 @@ Current issue mapping: | P2 | Hosted PII egress gate | Complete; [#10 hosted data-flow parity](https://github.com/dinpd/AgentPass/issues/10) | | P3 | Production deploy action gate | Complete | | P4 | Provider trust gate | Active; hosted JWS/JWKS receipt slice complete, contract drift, revocation, ledgered consumption, fixtures, and provider failure classes next; [#2 provider trust gate](https://github.com/dinpd/AgentPass/issues/2), [#8 production JWS/JWKS](https://github.com/dinpd/AgentPass/issues/8), [#9 execution receipts](https://github.com/dinpd/AgentPass/issues/9) | -| P5 | Framework and workflow distribution | [#13 OpenAI Agents SDK wrapper](https://github.com/dinpd/AgentPass/issues/13); select additional wrappers from adopter demand | +| P5 | Monotonic task capability state and protected-result release | Planned after P4; [#78 program](https://github.com/dinpd/AgentPass/issues/78), [#79 state contract](https://github.com/dinpd/AgentPass/issues/79), [#80 local enforcement](https://github.com/dinpd/AgentPass/issues/80), [#83 hosted transitions](https://github.com/dinpd/AgentPass/issues/83), [#81 network adapter](https://github.com/dinpd/AgentPass/issues/81), [#82 proof and fixtures](https://github.com/dinpd/AgentPass/issues/82) | +| P6 | Framework and workflow distribution | [#13 OpenAI Agents SDK wrapper](https://github.com/dinpd/AgentPass/issues/13); select additional wrappers from adopter demand | +| P7 | Downstream agent attribution | Follow the stable enforcement, provider-trust, and distribution foundations; [#75 attribution and provenance](https://github.com/dinpd/AgentPass/issues/75) | Issues [#6](https://github.com/dinpd/AgentPass/issues/6), [#7](https://github.com/dinpd/AgentPass/issues/7), and @@ -370,7 +395,79 @@ Current status: hosted path and expand the corpus with unknown-key, drifted-contract, and replayed-prior-outcome cases for MCP fine-grained authorization discussions. -#### P5: Framework And Workflow Distribution +#### P5: Monotonic Task Capability State And Protected-Result Release + +Add a task-scoped capability-state layer after the active provider-trust +milestone closes. Dispatch establishes an immutable capability ceiling. During +the task, declared protected events can retain or remove capabilities, but they +cannot widen the ceiling or restore a removed capability. + +The local tool-gate lifecycle evolves from: + +```text +authorize -> execute -> return result +``` + +to: + +```text +authorize -> execute and hold result -> classify -> narrow capabilities + -> fence stale work -> collect required acknowledgements -> release +``` + +Ship together: + +- A versioned task execution graph, task template, capability ceiling, state, + and state-version contract. +- Declarative protected-event transitions that name exactly which tools, + resources, destinations, or protocols are removed. +- Trusted result classification and a held-result boundary outside model + context. +- Monotonic local and hosted transitions. Ordinary approval cannot restore a + capability removed from the active task. +- Compare-and-set or single-writer hosted state, stale-version denial, and + cancellation or reauthorization of parallel and persistent work. +- An adapter contract that lets an external network enforcement point apply and + acknowledge the same transition without making AgentPass a network gateway. +- Direct transition evidence containing state and reference metadata, never + protected payloads. +- Portable local/hosted fixtures and a runnable reconciliation/exfiltration + demonstration. + +Demo gate: + +- A reconciliation task begins with processor-report read, two ledger reads, + one vendor-support operation, and one narrowly typed finance output. +- The processor report is held outside model context when classified protected. +- Before release, the task transitions from `baseline` to `restricted`, removes + processor, support, and external paths, and records all required enforcement + acknowledgements. +- A parallel call under the prior state version is denied or safely cancelled. +- Prompt-injection-style instructions in a ledger cannot send or upload account + history, even with a later ordinary approval. +- A task-bound opaque result reference can still produce the fixed-schema + finance summary at its declared recipient. +- Local and hosted tests reproduce the same state transitions, reason codes, + retry behavior, and evidence without logging protected contents. + +Implementation program: + +- [#78](https://github.com/dinpd/AgentPass/issues/78) tracks the milestone. +- [#79](https://github.com/dinpd/AgentPass/issues/79) defines the task graph, + capability ceiling, state machine, policy, and evidence contracts. +- [#80](https://github.com/dinpd/AgentPass/issues/80) adds protected-result + hold, classify, transition, and release to the local tool gate. +- [#83](https://github.com/dinpd/AgentPass/issues/83) implements durable hosted + transitions and stale-work fencing. +- [#81](https://github.com/dinpd/AgentPass/issues/81) defines the external + network-enforcement acknowledgement adapter. +- [#82](https://github.com/dinpd/AgentPass/issues/82) delivers the end-to-end + proof and conformance fixtures. +- Existing [#56](https://github.com/dinpd/AgentPass/issues/56) supplies + tool-result lineage, and [#7](https://github.com/dinpd/AgentPass/issues/7) + supplies related structured degradation semantics. + +#### P6: Framework And Workflow Distribution Add integrations only after the underlying feature being wrapped has a stable end-to-end demonstration. Select the next wrapper from real adopter demand; @@ -385,6 +482,22 @@ Demo gate: types. - Missing required context fails closed. +#### P7: Downstream Agent Attribution + +Add destination-aware, human-visible attribution only after the action boundary, +provider verification, and primary framework integrations are stable. Native +provider metadata and visible text labels must remain projections of trusted +AgentPass evidence, never authorization or cryptographic proof by themselves. + +Demo gate: + +- One provider-native metadata adapter and one visible text-label adapter bind + attribution to the same authorized execution and downstream object. +- Spoofed, stripped, altered, unsupported, and replayed attribution outcomes are + distinguishable without exposing credentials, raw receipts, reusable grants, + protected payloads, or unnecessary personal data. +- See [#75](https://github.com/dinpd/AgentPass/issues/75). + Work that does not directly unlock these demonstrations is lower priority: - additional positioning or naming work; @@ -874,6 +987,11 @@ Tone: - DID/VC as the top-level story. - Broad enterprise governance dashboard. - Multi-agent delegation as the primary wedge. +- A proprietary identity broker or OAuth replacement. +- A universal network gateway; AgentPass defines an enforcement adapter and + shared state contract instead. +- Claiming complete AAM or multiplayer access-control coverage before the + required identity, mediation, and principal-provenance boundaries exist. - Replacing IAM, OAuth, OPA, Cedar, OpenFGA, MCP authorization, or provider business rules. diff --git a/tests/test_positioning_docs.py b/tests/test_positioning_docs.py index 7d6f51c..26416c4 100644 --- a/tests/test_positioning_docs.py +++ b/tests/test_positioning_docs.py @@ -24,6 +24,7 @@ "Portable provider trust and interoperability", "Execution and outcome assurance", ] +AAM_URL = "https://blog.cloudflare.com/the-agent-access-model/" def test_readme_leads_with_product_category_and_canonical_positioning(): @@ -71,6 +72,33 @@ def test_readme_and_roadmap_share_the_three_product_layers(): assert "They advance these layers rather than forming separate product" in ROADMAP +def test_aam_reference_is_visible_and_preserves_agentpass_boundaries(): + assert AAM_URL in README + assert AAM_URL in ROADMAP + assert "implements the action-control and evidence layers" in README + assert re.search( + r"integrating with external identity brokers and network\s+enforcement", + README, + ) + assert "does not claim to implement the complete AAM architecture" in ROADMAP + assert "network enforcement remains an independent enforcement point" in ROADMAP + + +def test_roadmap_prioritizes_monotonic_capability_state_before_distribution(): + headings = [ + "#### P4: Provider Trust Gate", + "#### P5: Monotonic Task Capability State And Protected-Result Release", + "#### P6: Framework And Workflow Distribution", + "#### P7: Downstream Agent Attribution", + ] + positions = [ROADMAP.index(heading) for heading in headings] + assert positions == sorted(positions) + for issue_number in [78, 79, 80, 81, 82, 83]: + assert f"https://github.com/dinpd/AgentPass/issues/{issue_number}" in ROADMAP + assert "Ordinary approval cannot restore a" in ROADMAP + assert "A parallel call under the prior state version is denied" in ROADMAP + + def test_interoperability_and_package_metadata_support_product_positioning(): assert "open ecosystem strategy" in INTEROPERABILITY assert "[Project Positioning](positioning.md)" in INTEROPERABILITY