01 / The operating case
What changes in a real workflow?
Security needs to know which agent can invoke customer deletion and who can revoke it.
- 01Owner
- 02Agent + workload
- 03Task context
- 04Action decision
02 / Decision contract
What the executor must check
Record owner, runtime identity, deployment, tools, resource access, origin grants and lifecycle state; reconcile with observed calls.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
A static spreadsheet says an agent was retired while its credential continues to operate.
Evidence to retain
Preserve inventory version, ownership review, observed use and retirement proof.
04 / Canonical scope
Why this reference stands alone
Registry design owns system schema; inventory owns operational governance questions.
Technical artifact
Inventory record and drift signal
agent: support-resolver/A12 owner: support-ops workload: ticket-worker/v4 allowed tools: ticket.read, ticket.comment observed: customer.delete → drift alert
Run the denial test
Retire A12 in the registry but continue making calls through its old credential. Reconciliation must surface activity from a supposedly retired agent.
Primary references