/goal /ultracode-workflows [RBAC-4] retire the god-PAT — per-user delegated agent identity + per-app scoped read-only kube token #31

New issue

Closed

opened 2026-07-01 02:03:45 +00:00 by plat · 0 comments

plat commented

2026-07-01 02:03:45 +00:00

Owner

Track/Wave: RBAC-4 · Wave G4 · Size L
Repos: mcp, agents, gitops
Depends on: RBAC-1, RBAC-2

Why

PLAT_TOKEN (write:admin+read:admin) is shared by MCP, dispatcher, registry; a prompt-injected run can act with full admin across every tenant. The validated per-app namespaced read-only Role is the target shape.

Scope

gitops: per-app agent-ctx SA + namespaced read-only Role (pods/logs/events/services/deployments get/list/watch, no secrets) rendered per overlay. mcp: a TokenRequest-based short-lived namespace-scoped token replacing the embedded admin token. agents: authenticate the run AS the triggering user. DECISION NEEDED (resolve in-issue): Forgejo admin sudo/impersonation vs a platform-managed per-user PAT. Land behind a flag, one repo first.

Acceptance

A run by user A (write on X, no access to Y) can only touch X: agent calls against Y are rejected by RBAC-1, and the minted token lists pods/logs in X's namespace but 403s on Y, cluster-wide resources, or any secret — validated with two apps owned by different users in one org.

Notes

Seam B (overlay renderer) — after RBAC-2.

Part of the First Client Deploy → Governance roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.

**Track/Wave:** `RBAC-4` · Wave **G4** · Size **L** **Repos:** `mcp`, `agents`, `gitops` **Depends on:** RBAC-1, RBAC-2 ## Why PLAT_TOKEN (write:admin+read:admin) is shared by MCP, dispatcher, registry; a prompt-injected run can act with full admin across every tenant. The validated per-app namespaced read-only Role is the target shape. ## Scope gitops: per-app `agent-ctx` SA + namespaced read-only Role (pods/logs/events/services/deployments get/list/watch, no secrets) rendered per overlay. mcp: a TokenRequest-based short-lived namespace-scoped token replacing the embedded admin token. agents: authenticate the run AS the triggering user. DECISION NEEDED (resolve in-issue): Forgejo admin sudo/impersonation vs a platform-managed per-user PAT. Land behind a flag, one repo first. ## Acceptance A run by user A (write on X, no access to Y) can only touch X: agent calls against Y are rejected by RBAC-1, and the minted token lists pods/logs in X's namespace but 403s on Y, cluster-wide resources, or any secret — validated with two apps owned by different users in one org. ## Notes **Seam B (overlay renderer) — after RBAC-2.** --- *Part of the **First Client Deploy → Governance** roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.*

plat added this to the Client Deploy → Governance Roadmap milestone

2026-07-01 02:03:45 +00:00

plat added the

horizon:governance

roadmap

goal

labels

2026-07-01 02:03:45 +00:00

plat added a new dependency

2026-07-01 02:04:45 +00:00

#28 /goal /ultracode-workflows [RBAC-1] repo-permission authz in MCP (swap org-membership for the …/permission probe)

plat added a new dependency