How does Arcane secure AI agents?
Arcane verifies agent identity, replaces standing credentials with task-bound access, enforces policy inline, and records every decision as audit evidence.
Which controls protect each agent action?
Enforcement in the request path
SDK, proxy, MCP-aware, and ext_authz boundaries evaluate authority before a protected action executes. The supported topology and trust boundary are explicit deployment choices.
Short-lived access
Arcane identity tokens are short-lived and audience-bound. Downstream access uses proxy execution or scoped credential vending according to the resource's enforcement mode.
Structured and attributable
Decision evidence connects the user or system authority, registered agent, workload, task, resource, policy verdict, enforcement result, and reason. Tamper-evident audit remains an explicit roadmap item.
Defense in depth
Identity binding, contextual policy, and per-call enforcement layered together. Failure of any single layer doesn't yield standing access.
What security evidence does Arcane provide?
Specific claims with an explicit current-versus-roadmap boundary. Arcane does not present planned integrity controls as shipped evidence.
- Workload evidenceOIDC · Kubernetes · GCP · SPIFFE
- Enforcement boundariesSDK · proxy · MCP · ext_authz
- Decision attributionAuthority · agent · workload · task · policy
- Tamper-evident auditRoadmap · not claimed as shipped