Repository navigation
[Core]: Capability broker at egress — service access without credential custody #48
Description
Component
constraints / policy
Kind
enhancement
Description
Core membrane feature: agent expresses intent (buy milk, shop X, card Y); egress validates against declared capability scope; credentials never live in agent profile JSON.
| Concern | Design |
|---|---|
| Wrong merchant / SKU / card | Deny at egress before tool executes |
| Scope | Capability manifest on profile: capabilities: [{ id: shop-x-milk, allowed: { item: milk, card: Y } }] |
| Secrets | Vault ref / env / broker injects token at egress — agent sees capability id only |
| Audit | Spine records intent, scope check, allow/deny — no secret values |
Example: loop requests payment with card=Z when only card=Y bound → tool.call denied, audit report finding.
Implement as egress guard + optional arpa.auth.* type plugin — not a full IAM product. Adjustable strictness via spectrum (36): audit-only logs violation; high bind blocks.
Code or session context (optional)
aura/membrane/egress.py, spec/type-plugin.contract.md auth role. Tests: scoped allow/deny without plaintext keys in profile export.
Activity
bd-c3 commentedon Sep 15, 2026
I am working on a pull for this @rosspeili, can you asign pls?
feat: capability broker with named intents and secret refs (#48) (#85)
rosspeili commentedon Sep 16, 2026
Closed by #85