Govern (GV) · Authorization

Authorization at the Agent charter layer

advisory · Bypassable by language alone

Who is allowed to put this agent into the world, under what authority, accountable to what policy, with what retirement criteria?

What this cell does

Specific authorized scope. Named tools, MCP servers, environments, max-blast-radius. Scope expansion requires re-signature.

Artifacts (1)

checks.yamlview on GitHub

# ABOUTME: Machine-checkable definition of the Charter authorization / agent cell.
# ABOUTME: The audit prompts in this cell's README, expressed so a validator can score them.

cell:
  id: authorization.in-agent
  concern: authorization
  layer: in-agent
  authority: agent
  document: agent-charter
  owner: "Named human owner. Counter-signed by domain authority."
  question: "Does the agent charter declare a specific authorized scope (named tools, MCP servers, environments, RBAC role reference) that requires re-signature to expand?"

mappings:
  csf: "GV.PO-01, PR.AA-05"
  ai_rmf: "GOVERN 1.2, MANAGE 2.2"
  iso42001: "A.6"
  eu_ai_act: "Art. 26"

checks:
  - id: GV-AZ-A-01
    description: "Tools are enumerated rather than wildcarded at the top level."
    type: min_items
    target: "authorized_scope.tools_allowlist:1"
    document: agent-charter
    severity: blocking
    evidence: "Named tools; a bare '*' fails."
  - id: GV-AZ-A-02
    description: "Environments the agent may touch are enumerated."
    type: min_items
    target: "authorized_scope.environments:1"
    document: agent-charter
    severity: blocking
    evidence: "Named environments."
  - id: GV-AZ-A-03
    description: "The charter references the RBAC role that implements this scope at runtime."
    type: required_field
    target: "authorized_scope.rbac_role_ref"
    document: agent-charter
    severity: blocking
    evidence: "A role name resolvable in the cluster."
  - id: GV-AZ-A-04
    description: "No tool entry grants a wildcard verb."
    type: no_wildcard
    target: "authorized_scope.tools_allowlist"
    document: agent-charter
    severity: blocking
    evidence: "No entry equal to '*' or ending ':*:*'."

Cell notes

Charter, Authorization / Agent

Structural question. Does the agent charter declare a specific authorized scope (named tools, MCP servers, environments, RBAC role reference) that requires re-signature to expand?

Owner. Named human owner. Counter-signed by domain authority.

Template fragment

The authorized_scope: block of ../../templates/agent-charter.yaml:


authorized_scope:
  environments: [dev, staging]
  tools_allowlist:
    - Read
    - Glob
    - Grep
    - "Bash(git:status)"
    - "Bash(git:diff)"
    - "Bash(kubectl:get:*)"
  mcp_servers_allowlist: [filesystem, github]
  rbac_role_ref: agent-claude-code-prod-role
  iam_role_arn: arn:aws:iam::123456789012:role/claude-code-prod

Audit prompts

- For [agent X], does the charter scope match the runtime RBAC Role and IAM policy?
- Is rbac_role_ref the actual name of a Role committed to source-of-truth manifests?
- When was scope last expanded? Who signed the expansion?

Operational tie-in

- tools_allowlist → controls/authorization/client-side/settings.json allow list.
- mcp_servers_allowlist → controls/supply-chain/client-side/mcp-allowlist.json server names.
- rbac_role_ref → controls/authorization/server-side/ (the Role with that name must exist and contain only the verbs the charter allows).
- iam_role_arn → controls/identity/server-side/serviceaccount.yaml IRSA annotation and controls/authorization/server-side/aws-iam-scoped-policy.json.

If the charter scope and the runtime scope drift apart, that is a Sentinels finding: the drift detection in sentinels/approval-gating/server-side/audit-branch-protection.yml is the analogous pattern, but for agent scope it requires a custom drift check that compares charter YAML to live RBAC + IAM.

Citation

NIST CSF 2.0 GV.PO-01; PR.AA-05 (least privilege; charter dimension). NIST AI RMF GOVERN 1.4, MANAGE 2.4. ISO/IEC 42001 §A.6.2. EU AI Act Art. 14, Art. 15.

Crosswalk

NIST CSF 2 0	GV.PO-01, PR.AA-05
NIST AI RMF	GOVERN 1.4, MANAGE 2.4
ISO IEC 42001	§A.6.2
EU AI ACT	Art. 14, Art. 15

Cite this cell: https://agenticcovenants.com/govern/authorization/in-agent/