https://notes.karlmcguinness.com/series/testing-mission-bound-authorization/Recent content in Testing Mission-Bound Authorization on Control Plane by Karl McGuinnessHugoen-usWed, 22 Jul 2026 07:50:00 -0700https://notes.karlmcguinness.com/notes/closing-the-agent-authorization-gaps/Wed, 22 Jul 2026 07:50:00 -0700https://notes.karlmcguinness.com/notes/closing-the-agent-authorization-gaps/The standards community is converging on a problem statement: agents break OAuth’s pre-approval paradigm, tokens cannot represent delegation chains, revocation cannot reach a task, and consent screens cannot survive a thousand scopes. The agent authorization use-case catalog names nine scenarios and rolls its analysis up to five major gaps, and this part answers the catalog line by line at both grains with machinery that existed before it was published: task-level revocation is the Mission kill switch, bulk revocation is Mission Management, multi-hop chains are act chains and Child Missions, scope explosion dies at Mission-grain consent, and the paradigm mismatch is the discovery loop. One answer is partial and one is delegated, and the tally is stated rather than smoothed.https://notes.karlmcguinness.com/notes/making-compliance-a-by-product/Wed, 22 Jul 2026 07:40:00 -0700https://notes.karlmcguinness.com/notes/making-compliance-a-by-product/The third kind of outside framing is the one with auditors behind it. NIST AI RMF, the EU AI Act, and ISO/IEC 42001 converge on one demand: show me. Show me who is accountable, what the system is for, how you observe it, and how you stop it. In most agent stacks the honest answer is archaeology through session logs. In this architecture the artifact that enforces is the artifact that documents: the Mission is the documented purpose, the approval is the accountable decision, the evidence family is the log, and Termination is the interrupt. The crosswalk maps eight obligations onto machinery that exists for safety reasons, and then names what compliance still requires, because evidence is not certification.https://notes.karlmcguinness.com/notes/containing-the-owasp-agentic-threats/Wed, 22 Jul 2026 07:30:00 -0700https://notes.karlmcguinness.com/notes/containing-the-owasp-agentic-threats/Security reviewers do not arrive with your framing. They arrive with OWASP’s: fifteen agentic threats from memory poisoning to human manipulation, plus the LLM Top 10. This part crosswalks both onto the handbook and refuses the move that makes crosswalks worthless, claiming everything. Each threat gets one of three verdicts. Contained means the threat lands on machinery built for it, with a draft behind it. Bounded means the cause is out of authorization’s reach but the blast radius is capped at the action gate. Delegated means it is not an authorization problem and a named complement owns it. Six of the fifteen are contained, nine are bounded, and half the LLM Top 10 is honestly someone else’s layer.https://notes.karlmcguinness.com/notes/answering-the-laws-of-aidentity/Wed, 22 Jul 2026 07:20:00 -0700https://notes.karlmcguinness.com/notes/answering-the-laws-of-aidentity/Patrick Parker’s Seven Laws of AIdentity describe the dynamics a system must govern when agents act through delegated authority: split actors, generated intent, bounded agency, continuous authorization, least exposure, justifiable action chains, and proof-carrying action. This part maps those laws onto Mission-Bound Authorization without turning resemblance into compliance. The strongest matches are generated intent and bounded agency. Continuous authorization and split-actor attribution require the runtime and identity profiles. Least exposure, chain necessity, policy retention, evidence completeness, and embodied action remain conditional or outside the current wire model.https://notes.karlmcguinness.com/notes/splitting-the-lethal-trifecta/Wed, 22 Jul 2026 07:10:00 -0700https://notes.karlmcguinness.com/notes/splitting-the-lethal-trifecta/Simon Willison named the combination that makes agents dangerous: access to private data, exposure to untrusted content, and the ability to communicate externally, held together in one loop. Any two legs are safe. All three are an exfiltration machine waiting for a poisoned document. This part runs the handbook against that threat model: the three legs become separately typed action classes under one Mission, the external leg becomes a consequential action that needs a fresh parameter-bound permit, mediated custody keeps the egress credential out of the agent’s hands, and the harness downgrades egress once untrusted content enters the session. Then the honest residuals: enforcement scope, composition, and the semantic gap.