CHAPTER 01
Identity before access
Human and agent clients act through attributable, revocable identities.
- SourceWorkspace administrator
- ActorClaude Code / agent
- ScopeLaunch narrative · read
- ConsequenceEvery request is tied to one revocable client
Grant only the access the task needs.
Every agent uses a revocable identity, an explicit scope, and a complete audit trail.
Publishing gate ·Customer proofrunning
Codex · launch agentWorking on the launch narrative
Draft launch storycomplete
Verify customer quoterunning
Publish customer proofwaiting
Update launch checklistwaiting
Decision gate
publish.execute · heldexecution paused hereDecision packetPreparing impact preview
Assembling the boundaryEvidence and dependent runs remain inspectable.
Codex reaches a consequential action outside its current grant.
Trace identity → grant → policy → action.
Inspect current state and evidence for each control.
Identity
People and agents act through attributable, revocable identities.
- Current state
- client-04 · active
- Owner
- Workspace administrator
- Evidence
- Available in audit history
Know what crossed the boundary.
Every delivery stays tied to an identity, a grant, a policy decision, and an audit event.
Review the trust modelOpen the access history.
Start with the agent identity. Follow the grant, policy result, action, and audit event.
- 01Identity
- 02Grant
- 03Policy
- 04Audit