How does agent identity become authority?
Arcane binds a user, agent, and attested workload, then evaluates that composite identity against task and resource policy on every action.
What forms an agent principal?
A principal is assembled from trusted identity evidence rather than an agent-provided name. The resulting identity stays bound to its delegating authority and expires with the task context.
Authority begins with verified evidence.
User identity, agent registration, and workload attestation form one expiring principal. No component can add authority that was absent from the evidence or delegation chain.
- User verified · OIDC
- maya@revenue
- Agent registered
- research-agent@v0.4
- Workload attested
- spiffe://prod/research-17
What happens between an agent and a resource?
Arcane connects identity evidence, delegated authority, source-zone egress, target-zone ingress, approvals, audit, and task context at the agent action boundary. It integrates with IdPs, registries, and downstream services rather than replacing them.
Which controls shape each authority decision?
Verified identity
Agents do not self-assert who they are. Arcane binds trusted workload evidence, the acting agent, and delegated authority into a principal policy can evaluate.
Subtractive authority
Policy layers and delegation hops can narrow access but never widen it. The complete chain remains visible instead of being flattened into impersonation.
Two-sided policy
Source-zone egress and target-zone ingress are evaluated together. The resource owner must explicitly permit an action; silence is not permission.
One decision record
Approvals, audit evidence, task context, and cost attribution stay connected to the identity and policy verdicts for each action. Incomplete evidence fails closed.