Defending the Agent: Identity, Credential and Protocol Tools

All courses / Tools / Module 6 / Chapter 20

Learning objectives

After the lesson the participant can:

Register an agent identity with owner, scope, lifetime and a tested revocation.
Distinguish the permission manifest from the containment profile by purpose and by who enforces each.
Classify the tools of a tool server by effect and attach approval requirements to irreversible ones.
Assess an operator's AI against the idea of Tier 0 and identify the control that carries the weight in each usage mode.

Key concepts

Agent identity record: A record from The Transformed Security Architect, Chapter 8, registering an agent identity with owner, operator, authority, scope, lifetime and revocation. The broker issues from it, and an expiry disables the identity if a review is missed.
Agent permission manifest: A deny-by-default declaration, from AI Platform and Security, of the tools, data, identity, budgets and approval gates an agent may use. It is kept in version control and read by the policy decision point and the pipeline.
Containment profile: A per-agent ceiling, family CP, of identity, egress, data, blast radius, stop holders and verification tests. The pipeline rejects a manifest grant the ceiling does not cover, and the profile must hold whether or not the manifest is obeyed.
Tool registry entry: A registration of a tool server with owner, scopes and trust, classifying each tool as read, reversible-write or irreversible. The agent pipeline refuses a manifest that names a server or tool absent from the registration.
Tier-0 checklist for the operator's AI: A checklist of AI Operations with controls for remediation agents, runbook libraries, observability pipelines and configuration maps. The operator's AI is Tier 0 because credentials, runbooks, telemetry and the stop path meet there.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Sort

Four files the agent cannot write

Sort each content into the file that carries it in Chapter 20.

Interactive exercise 2 · Match

Protocols, formats and identity standards

Match each third-party standard or format of Chapter 20 with what it is.

Teaching plan

15 min	Present Figure 20.1, agent identity and containment: four files the agent cannot write. Read the identity record of Hansa Mutual's evidence-collection agent.
20 min	Teach protocols and standards: the Model Context Protocol, Agent2Agent, Agent Skills, SPIFFE and token exchange, the tool registry entry, and the rule about read-only switches.
15 min	Compare the permission manifest and the containment profile CP-HM-ITOPS-01, including its dependencies block. Read the AGENTS.md example and state its limit.
30 min	Exercise: participants write an identity record, a permission manifest outline and a containment ceiling for one agent.
10 min	Debrief: for each agent, would the containment hold if the manifest were ignored?

Discussion

The dependencies block of the containment profile lists what its controls share, so that two controls that fail together are not counted as two. Which of your agent controls share a dependency?
An instruction file for a coding agent carries instructions, not enforcement. What does Hansa Mutual pair it with, and what would you pair it with in your repositories?
The standards that agents rely on carry calls and identities, but none decides who answers for what the calls do. Which record of this chapter gives that answer?

Written exercise

Exercise · 30 minutes

Identity, manifest and containment for one agent

Choose one agent in your organisation, or a coding agent working in a Hansa Mutual repository. Write three short files as outlines. First, an identity record: the decision record that grants the level, the workload identity, the issuer outside the agent runtime, owner and operator, scopes with levels, maximum token lifetime, review date and how revocation is tested. Second, a deny-by-default permission manifest: the tool servers it may reach, each tool classed as read, reversible-write or irreversible, with an approval requirement on every irreversible tool, plus budgets. Third, a containment ceiling: egress default, data classes, blast radius, stop holders, and the verification test for each. Mark any control that relies on the agent obeying an instruction.

Deliverable: Three outlines for one agent: identity record, permission manifest with tool classes and approvals, and containment ceiling with verification tests.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

What rule does the series draw from the tool servers that offer a read-only setting?
Show the answer
C. A read-only switch in a tool is a convenience; the hard limit is the permission of the identity behind the server
The chapter states the rule directly: a read-only switch in a tool is a convenience, and the hard limit is the permission of the identity behind the server, enforced outside the model.
How does the chapter divide the work between the permission manifest and the containment profile?
Show the answer
B. The manifest states the agent's declared intent; the profile is the platform's commitment and holds even if the manifest is not obeyed
The Summary states that the two artefacts have two jobs, the agent's declared intent and the platform's commitment, and that the profile must hold whether or not the manifest is obeyed.
Who sets the classification of a containment profile as verified, declared or failed?
Show the answer
D. The last test result, not the owner
The profile is owned by a named person, but its classification as verified, declared or failed is set by the last test result and not by the owner.