Stéphane Tailland
8f1f0245da
The standing authority the autonomous runs act under: an offline refresh token issued by a new classic-models-mandate client for the user who authorised the agent, stored in Vault, redeemed at trigger time. The mandate client holds no domain audience. It cannot reach data; it can only say who authorised whom. Direct access grants on it is a lab shortcut, noted as such — mandating an agent is a decision a person takes, and a password grant records no consent where the authorization code flow would. Verified end to end: refresh gives sub=pm-user azp=classic-models-mandate with the agent in the audience, the agent exchanges it to azp=itself and aud=mcp-catalog, and the MCP call answers 200. sub stays the person who mandated, azp says which agent acted. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>