Roadmap
What's shipped, what's next, and the order we're building in.
Where this is going
Every enterprise already has AI agents at work, and nearly all of them authenticate with a developer's personal access token or API key pasted into a local file. The agent is the developer: same scope, same audit trail, no separate off switch.
The goal is to give each agent runtime an identity of its own — delegated from a developer, governed by the enterprise's existing machinery, and never backed by a credential the agent can read. The delegation principle — at most the developer, usually less — is the invariant everything below serves.
Note
Today that bound is emergent: it follows from entitlement sources being keyed to the human and from default-deny policy. Making it an explicit, testable check is tracked in Milestone 2.
Status
| # | Milestone | Status |
|---|---|---|
| 1 | Secretless Git runtime | Done |
| 2 | Real workload identity | Partial |
| 3 | Enterprise entitlement adapters | Partial |
| 4 | Provider-native enforcement | Planned |
| 5 | Controlled egress | Done |
| 6 | Enterprise control plane | Partial |
1. Secretless Git runtime — done
Exit criterion, met: an untrusted agent can clone, fetch, and push an approved branch with no GitHub credential anywhere in its process environment or filesystem.
- Git smart-HTTP broker, GitHub App token minting, KMS/HSM signing
- Ref-level policy with deny precedence and operation scoping
- Durable one-time approvals, host CLI, OIDC web UI, Slack, multi-reviewer rules
- Hash-chained audit with rotation, verification, and off-host forwarding
- Brokered PRs, reviews, merges, CI logs, fork PRs, Git LFS
- Shallow pushes, allowlisted push options, opt-in Unicode refs
- Content scanning, isolated Docker workspace, live GitHub smoke test
- Rate limits, concurrency caps, disk-low fail-closed, protocol fuzzing
Remaining: live GitHub coverage for PR/CI permission edge cases; AI tool installation profiles for the workspace image. Signed pushes and SHA-256 repositories are rejected by design because GitHub doesn't support them.
2. Real workload identity — partial
A signed runtime assertion, minted outside the agent and verified on every request, replaces config-file identity.
Shipped
- Ed25519 assertions bound to the workspace token, verified per request, used in audit and approvals
- Revocation by
jtior runtime ID via a local file or signed control-plane bundles agentgate renewand renewal on container start
Planned
- Delegation invariant. Reject at verification time any assertion whose claimed
team,application, ormodeisn't a subset of what the entitlement sources report for itshuman, with a distinct error code and audit record. - Issuer hardening. An issuing service that requires the developer's OIDC login before minting, so "developer issues to agent" is itself authenticated.
- Per-runtime identity for the egress proxy and model gateway, so those streams attribute to a runtime instead of a source address.
- Multiple concurrent runtimes per broker with distinct client tokens.
3. Enterprise entitlement adapters — partial
Baseline (who the developer is) and elevation (what they're working on right now) compile into one envelope that rules gate on with requires, failing closed on source errors.
| Source | Kind | Status |
|---|---|---|
| AD / Entra groups (static export) | baseline | Available |
| Backstage ownership (static export) | baseline | Available |
| GitHub team membership | baseline | Available |
| Jira work item | elevation | Available |
| Live AD/Entra (Graph) and Backstage lookups | baseline | Planned |
| GitLab group membership | baseline | Planned |
| ServiceNow incident / change | elevation | Planned |
| PagerDuty incident | elevation | Planned |
The servicenow and pagerduty task systems are already accepted in assertions; only the lookup sources are missing, and rules requiring them never apply until they land. Entitlement expiry and revocation pushed from the control plane is tracked under Milestone 6.
4. Provider-native enforcement — planned
Providers beyond GitHub, preferring short-lived provider-native credentials over command interception. Every adapter follows the provider adapter plan template and keeps its root credential out of the workspace — a KMS signer or the provider's own workload identity federation.
- Provider interface and contract test — available
- GitLab (Git, merge requests, pipelines)
- AWS STS / workload identity
- Azure workload identity
- Kubernetes impersonation and scoped service accounts
- Internal HTTP APIs behind an allowlist, with the runtime identity forwarded as a header
5. Controlled egress — done
- Allowlisting CONNECT proxy with SSRF-safe resolution, byte quotas, closed workspace DNS, GitHub always denied direct
- Model gateway with its own client token, anchored path allowlists, per-address and global budgets
Remaining: runtime-attributed budgets once per-runtime gateway identity lands.
6. Enterprise control plane — partial
Shipped: signed policy and revocation distribution with persisted version high-water marks; broker inventory, heartbeats, and audit-head anchoring with rollback detection; SIEM detections D1–D7 with a triage CLI.
Planned: central approvals across brokers; entitlement expiry and revocation pushed on offboarding or team change; runtime inventory (which identities are live, where, issued by whom); risk analytics per runtime and per developer; cross-broker chain verification against anchored heads.
Non-goals
- The model is never the authorization authority. Deterministic policy and provider-native permissions are the enforcement boundary.
- MCP is never required. The runtime stays useful with Cursor, Copilot, Claude Code, Codex, and whatever comes next, unmodified.
- Provider-side protections aren't replaced. Branch rules, required reviews, and IAM policies remain the provider's to enforce; AgentBox narrows what reaches them.