refactor: an autonomous run is a machine identity, not a mandate
Withdrawn: the offline_access mandate built an hour ago. An agent running on its own account acts for itself. Nobody asked for the 06:00 run, so naming a person as its principal was a fiction — and choosing which person was arbitrary, as the first implementation showed by picking whichever test user was to hand. It also cost more than it was worth. An offline token has no exp, dies only after 30 days unused, is not rotated on use, and is revocable only by killing that user's offline session: a permanent bearer credential standing in for a consent nobody gave. Now client_credentials, with the service account carrying read_only — the least privilege the job needs. That is not a convention the workflow observes: the MCP server maps the role to a consumer group at discovery, so tools/list under this identity returns get-product and list-products and nothing else. create-product is invisible rather than merely unused. Nothing downstream changes. azp still names the agent, audiences are still per-server, and policy still reads roles — a service account has roles like anyone else. The mandate client stays in the realm, unused, for the case where a person's own authority genuinely is in play: Recouvrement's dunning, which is human-validated already. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Stéphane Tailland
+15
-10
@@ -106,18 +106,23 @@ scanned 110 of 110, complete
|
||||
escalate: true
|
||||
```
|
||||
|
||||
### It stops without a mandate, and that is the point
|
||||
### It acts under its own machine identity
|
||||
|
||||
No user session exists at 06:00, so authority has to be pre-established. The
|
||||
design calls for an `offline_access` mandate — the authorising user's refresh
|
||||
token, stored encrypted, exchanged at trigger time, so `sub` stays the person
|
||||
who mandated and `azp` says which agent acted.
|
||||
`client_credentials`, not a mandate. An agent running on its own account acts
|
||||
for itself — nobody asked for the 06:00 run, so naming a person as its principal
|
||||
is a fiction and choosing which person is arbitrary.
|
||||
|
||||
**That does not exist yet.** The first node looks for
|
||||
`APPROVISIONNEMENT_MANDATE_TOKEN` and, finding none, halts before any exchange
|
||||
and before reading anything. Verified: the run completes, `Exchange token` never
|
||||
executes, nothing is read. An agent without an identity does nothing rather than
|
||||
inventing an authority.
|
||||
The service account carries **`read_only`**, and the MCP server maps that to a
|
||||
consumer group at discovery, so `create-product` is not merely unused — it is
|
||||
invisible to this identity:
|
||||
|
||||
```
|
||||
tools/list under the machine identity → get-product, list-products
|
||||
```
|
||||
|
||||
Least privilege enforced by the realm and the gateway rather than by this
|
||||
workflow behaving itself. An earlier revision used an `offline_access` mandate;
|
||||
see CLAUDE.md for why it was withdrawn.
|
||||
|
||||
### The proposal has nowhere to go
|
||||
|
||||
|
||||
@@ -21,48 +21,6 @@
|
||||
0
|
||||
]
|
||||
},
|
||||
{
|
||||
"parameters": {
|
||||
"jsCode": "// No user session exists at 6am, so the authority has to be pre-established.\n//\n// NOT IMPLEMENTED. The design calls for an offline_access mandate: the user who\n// authorises the agent obtains a refresh token, it is stored encrypted, and the\n// exchange happens at trigger time \u2014 so `sub` stays the person who mandated and\n// `azp` says which agent acted.\n//\n// Until that exists this run has no identity of its own. It reads\n// APPROVISIONNEMENT_MANDATE_TOKEN from the environment if one was placed there\n// by hand, and stops cleanly otherwise rather than inventing an authority.\nconst token = $env.APPROVISIONNEMENT_MANDATE_TOKEN;\nif (!token) {\n return [{ json: {\n halted: true,\n reason: 'No mandate. This run needs an offline_access token from the user who '\n + 'authorised the agent; none is configured, so it did nothing.',\n }}];\n}\nreturn [{ json: { halted: false, token } }];\n"
|
||||
},
|
||||
"id": "mandate",
|
||||
"name": "Mandate",
|
||||
"type": "n8n-nodes-base.code",
|
||||
"typeVersion": 2,
|
||||
"position": [
|
||||
220,
|
||||
0
|
||||
]
|
||||
},
|
||||
{
|
||||
"parameters": {
|
||||
"conditions": {
|
||||
"options": {
|
||||
"caseSensitive": true,
|
||||
"version": 2
|
||||
},
|
||||
"conditions": [
|
||||
{
|
||||
"leftValue": "={{ $json.halted }}",
|
||||
"rightValue": false,
|
||||
"operator": {
|
||||
"type": "boolean",
|
||||
"operation": "false"
|
||||
}
|
||||
}
|
||||
],
|
||||
"combinator": "and"
|
||||
}
|
||||
},
|
||||
"id": "has-a-mandate?",
|
||||
"name": "Has a mandate?",
|
||||
"type": "n8n-nodes-base.if",
|
||||
"typeVersion": 2,
|
||||
"position": [
|
||||
440,
|
||||
0
|
||||
]
|
||||
},
|
||||
{
|
||||
"parameters": {
|
||||
"method": "POST",
|
||||
@@ -73,7 +31,7 @@
|
||||
"parameters": [
|
||||
{
|
||||
"name": "grant_type",
|
||||
"value": "urn:ietf:params:oauth:grant-type:token-exchange"
|
||||
"value": "client_credentials"
|
||||
},
|
||||
{
|
||||
"name": "client_id",
|
||||
@@ -83,14 +41,6 @@
|
||||
"name": "client_secret",
|
||||
"value": "={{ $env.APPROVISIONNEMENT_CLIENT_SECRET }}"
|
||||
},
|
||||
{
|
||||
"name": "subject_token",
|
||||
"value": "={{ $json.token }}"
|
||||
},
|
||||
{
|
||||
"name": "subject_token_type",
|
||||
"value": "urn:ietf:params:oauth:token-type:access_token"
|
||||
},
|
||||
{
|
||||
"name": "scope",
|
||||
"value": "openid mcp-catalog-audience token-exchange-broker-audience"
|
||||
@@ -99,13 +49,13 @@
|
||||
},
|
||||
"options": {}
|
||||
},
|
||||
"id": "exchange-token",
|
||||
"name": "Exchange token",
|
||||
"id": "machine-token",
|
||||
"name": "Machine token",
|
||||
"type": "n8n-nodes-base.httpRequest",
|
||||
"typeVersion": 4.2,
|
||||
"position": [
|
||||
660,
|
||||
-100
|
||||
220,
|
||||
0
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -141,8 +91,8 @@
|
||||
"type": "n8n-nodes-base.httpRequest",
|
||||
"typeVersion": 4.2,
|
||||
"position": [
|
||||
880,
|
||||
-100
|
||||
440,
|
||||
0
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -154,7 +104,7 @@
|
||||
"parameters": [
|
||||
{
|
||||
"name": "Authorization",
|
||||
"value": "=Bearer {{ $('Exchange token').item.json.access_token }}"
|
||||
"value": "=Bearer {{ $('Machine token').item.json.access_token }}"
|
||||
},
|
||||
{
|
||||
"name": "Accept",
|
||||
@@ -182,8 +132,8 @@
|
||||
"type": "n8n-nodes-base.httpRequest",
|
||||
"typeVersion": 4.2,
|
||||
"position": [
|
||||
1100,
|
||||
-100
|
||||
660,
|
||||
0
|
||||
],
|
||||
"alwaysOutputData": true
|
||||
},
|
||||
@@ -196,19 +146,8 @@
|
||||
"type": "n8n-nodes-base.code",
|
||||
"typeVersion": 2,
|
||||
"position": [
|
||||
1320,
|
||||
-100
|
||||
]
|
||||
},
|
||||
{
|
||||
"parameters": {},
|
||||
"id": "no-mandate",
|
||||
"name": "No mandate",
|
||||
"type": "n8n-nodes-base.noOp",
|
||||
"typeVersion": 1,
|
||||
"position": [
|
||||
660,
|
||||
120
|
||||
880,
|
||||
0
|
||||
]
|
||||
}
|
||||
],
|
||||
@@ -217,43 +156,14 @@
|
||||
"main": [
|
||||
[
|
||||
{
|
||||
"node": "Mandate",
|
||||
"node": "Machine token",
|
||||
"type": "main",
|
||||
"index": 0
|
||||
}
|
||||
]
|
||||
]
|
||||
},
|
||||
"Mandate": {
|
||||
"main": [
|
||||
[
|
||||
{
|
||||
"node": "Has a mandate?",
|
||||
"type": "main",
|
||||
"index": 0
|
||||
}
|
||||
]
|
||||
]
|
||||
},
|
||||
"Has a mandate?": {
|
||||
"main": [
|
||||
[
|
||||
{
|
||||
"node": "Exchange token",
|
||||
"type": "main",
|
||||
"index": 0
|
||||
}
|
||||
],
|
||||
[
|
||||
{
|
||||
"node": "No mandate",
|
||||
"type": "main",
|
||||
"index": 0
|
||||
}
|
||||
]
|
||||
]
|
||||
},
|
||||
"Exchange token": {
|
||||
"Machine token": {
|
||||
"main": [
|
||||
[
|
||||
{
|
||||
|
||||
Reference in New Issue
Block a user