https://notes.karlmcguinness.com/series/agent-control-points/Recent content in Agent Control Points on Control Plane by Karl McGuinnessHugoen-usMon, 10 Aug 2026 16:00:00 -0700https://notes.karlmcguinness.com/notes/kerberos-won-because-nobody-had-to-implement-it/Mon, 10 Aug 2026 16:00:00 -0700https://notes.karlmcguinness.com/notes/kerberos-won-because-nobody-had-to-implement-it/The question worth asking about AAuth is not only whether the protocol is good. Kerberos won because of everything around the protocol: SSPI and GSS-API hid the mechanism from application developers, the LSA owned keys and ticket lifecycle, machine accounts existed as a side effect of domain join, Active Directory shipped the KDC by default, and SPNEGO made rollout incremental. Mapping that stack onto agents names the first control point in this series: the provider seam through which a harness or gateway acquires and presents credentials without exposing the mechanism to agent logic. MCP clients, SPIFFE, cloud identity systems, vendor brokers, and HTTP message-signature negotiation supply pieces, but no general seam composes them. That seam still cannot decide whose agent is running, which work is approved, or whether a resource permits one action. Those are separate records and decisions.https://notes.karlmcguinness.com/notes/the-runtime-mints-the-identity/Mon, 10 Aug 2026 15:00:00 -0700https://notes.karlmcguinness.com/notes/the-runtime-mints-the-identity/Agent runtimes naturally create the first trustworthy evidence about an instance, which gives them the default position in agent identity. Runtime proof and enterprise binding are still separate jobs. In heterogeneous enterprises, a binding layer can map evidence from many runtimes into durable Agent and Agent Deployment records and supply that governed context to credential issuers and resources. It is a real control plane only if the enterprise state survives changing runtimes. In the open world, model-provider harnesses are better positioned to integrate the stack because they hold the user relationship and execution loop. Distribution determines the default. Standard seams determine whether it can be challenged. Even a won binding layer answers whose agent is running, not whether its current work remains approved. That requires the third control point, an approved-task record with its own lifecycle.https://notes.karlmcguinness.com/notes/agent-authority-has-no-system-of-record/Mon, 10 Aug 2026 14:00:00 -0700https://notes.karlmcguinness.com/notes/agent-authority-has-no-system-of-record/Agent task authority is scattered across four de facto records: harness permission prompts, OAuth grants, IAM roles, and change tickets. Each performs a real job, but none is a general, portable system of record for approved work. An action click is not task approval, a grant is not a task lifecycle, and an identity role is not a reason for one undertaking. The missing object is an approved-task record with its own owner, bounds, lifecycle, and evidence relationships. Existing standards provide much of the transport for structured requests, user interaction, decisions, and credential projection. They do not yet supply shared task semantics, lifecycle propagation, trust, or enforcement behavior. Four plays are competing to mint the record, and the contest turns on distribution, durable state, and resource acceptance.