Security architecture guide
Design agent identity, delegation, workload authorization, scoped tool access, credential boundaries, approvals, and evidence for enterprise AI workflows.
Resolve the authenticated actor, tenant, workspace, agent definition and workflow version independently. A prompt claim or display name is not an authorization credential.
Evidence: Authenticated subject plus tenant, workspace, agent, and workflow identifiers
Evaluate the MCP connection, tool, action class, resource, scope, budget, and approval requirement for each consequential action.
Evidence: Requested capability, effective policy, allow or deny result, and reason
Resolve the approved connector credential only after policy permits the action. Return the scoped result rather than exposing a reusable bearer token to model context.
Evidence: Credential reference, audience, expiry, execution receipt, and redaction state
Retain who delegated work, which authority the agent exercised, where approval changed the plan, and which downstream outcome was accepted.
Evidence: Delegation chain, approval event, tool receipt, and outcome correlation
Resolve the human or service subject and its tenant boundary.
Attach the workspace, agent, workflow version, resource, and requested action.
Evaluate policy, scope, budget, credential, and approval requirements.
Correlate the decision, execution receipt, human intervention, and outcome.