Roadmap

What's shipped, what's next, and the order we're building in.

Where this is going

Every enterprise already has AI agents at work, and nearly all of them authenticate with a developer's personal access token or API key pasted into a local file. The agent is the developer: same scope, same audit trail, no separate off switch.

The goal is to give each agent runtime an identity of its own, delegated from a developer, governed by the enterprise's existing machinery, and never backed by a credential the agent can read. The delegation principle, at most the developer, usually less, is the invariant everything below serves.

Status

1. Secretless Git runtime — done

Exit criterion, met: an untrusted agent can clone, fetch, and push an approved branch with no GitHub credential anywhere in its process environment or filesystem.

• Git smart-HTTP broker, GitHub App token minting, built-in AWS KMS signing (SigV4, Pod Identity/IRSA) and generic KMS/HSM signing
• Ref-level policy with deny precedence and operation scoping
• Durable one-time approvals, host CLI, OIDC web UI, Slack, multi-reviewer rules
• Hash-chained audit with rotation, verification, and off-host forwarding
• Brokered PRs, reviews, merges, CI logs, fork PRs, Git LFS
• Shallow pushes, allowlisted push options, opt-in Unicode refs
• Content scanning, isolated Docker workspace, Dev Container attach, Claude Code workspace profile, live GitHub smoke test
• Rate limits, concurrency caps, disk-low fail-closed, protocol fuzzing

Remaining: live GitHub coverage for PR/CI permission edge cases. Signed pushes and SHA-256 repositories are rejected by design because GitHub doesn't support them.

2. Real workload identity — mostly done

A signed runtime assertion, minted outside the agent and verified on every request, replaces config-file identity.

Shipped

• Ed25519 assertions bound to the workspace token, verified per request, used in audit and approvals
• Revocation by jti or runtime ID via a polled local file or signed control-plane bundles
• agentgate renew and renewal on container start
• Issuing service behind oauth2-proxy: the developer's OIDC login is the human claim, assertions bind to a token fingerprint, a dashboard lists and revokes runtimes
• Delegation bound at issuance (team limited to what the directory, Okta, or Entra says the developer holds) and at verification (identity.delegation: "enforce", DELEGATION_MISMATCH / DELEGATION_UNKNOWN, audited)
• Fleet mode: many workspaces per broker, each authenticated by its own assertion-bound token; per-runtime request budgets
• Per-runtime identity at the model gateway and egress proxy: the assertion travels as x-agentgate-runtime (Anthropic SDKs, Claude Code) and as proxy credentials (Git, curl, npm, pip, apt); both services verify it against the issuer keys, attribute every event, and keep budgets and quotas per runtime

Planned

• Checking application and mode claims against sources, not only team

3. Enterprise entitlement adapters — partial

Baseline (who the developer is) and elevation (what they're working on right now) compile into one envelope that rules gate on with requires, failing closed on source errors.

Entitlement expiry and revocation pushed from the control plane is tracked under Milestone 6.

4. Provider-native enforcement — planned

Providers beyond GitHub, preferring short-lived provider-native credentials over command interception. Every adapter follows the provider adapter plan template and keeps its root credential out of the workspace.

• Provider interface and contract test — available
• GitLab (Git, merge requests, pipelines, job traces, protected-branch verification) via an OAuth refresh token the broker rotates — available; LFS deferred
• GitHub provider-native enforcement for hosted agents (required check run driven by policy) — available
• AWS STS / workload identity
• Azure workload identity
• Kubernetes impersonation and scoped service accounts
• Internal HTTP APIs behind an allowlist, with the runtime identity forwarded as a header

5. Controlled egress — done

• Allowlisting CONNECT proxy with SSRF-safe resolution, byte quotas, closed workspace DNS, GitHub always denied direct

• Model gateway with its own client token, anchored path allowlists, per-address and global budgets

• Runtime-attributed model budgets (budget.maxRequestsPerHourPerRuntime) and egress byte quotas per runtime and rule, keyed by the verified assertion

6. Enterprise control plane — partial

Shipped: signed policy and revocation distribution with persisted version high-water marks; broker inventory, heartbeats, and audit-head anchoring with rollback detection; SIEM detections D1–D7 with a triage CLI; central approvals across brokers (brokers publish pending approvals, reviewers decide in the control plane's UI, decisions return as signed reviews documents); runtime inventory at the issuer.

Planned: entitlement expiry and revocation pushed on offboarding or team change; cross-broker runtime correlation; risk analytics per runtime and per developer; cross-broker chain verification against anchored heads.

7. Adoption surface — partial

The security model only matters if developers land in it by default, with whatever agent they already use.

Shipped: Dev Container attach for VS Code, Cursor, and Windsurf with editor credential injection off and an IDE egress allowlist; the Claude Code workspace profile; npm run bootstrap for per-machine setup, with compose.enterprise.yaml keeping SIEM and OIDC settings off developer machines.

Shipped: hosted-agent coverage (Copilot coding agent, Cursor background agents) through webhooks, the github.pr.hosted action, a required check run, and the existing approval store.

Planned: a prebuilt workspace image with the IDE server baked in; further tool profiles (Codex CLI, Aider, toolchains); a one-command trial; IDE model traffic through the gateway (blocked on vendors); hosted-agent attribution from the vendor's own task record; Coder, Codespaces, Gitpod/Ona, and DevPod templates; control-plane-distributed fleet defaults.

Non-goals

• The model is never the authorization authority. Deterministic policy and provider-native permissions are the enforcement boundary.
• MCP is never required. The runtime stays useful with Cursor, Copilot, Claude Code, Codex, and whatever comes next, unmodified.
• Provider-side protections aren't replaced. Branch rules, required reviews, and IAM policies remain the provider's to enforce; AgentBox narrows what reaches them.