End-to-end Agent IAM platform

Goal

Combine projects 1-4 into one production-style platform that a hypothetical mid-size SaaS could use to ship agents safely. Build the demo around two real agents: a Helpdesk Agent (medium risk) and a Refund Agent (high risk). Deliver a public repo + demo video + threat-model PDF + governance docs.

Stack

• IdP: Keycloak (or Auth0 hosted) — realms agents-prod and agents-stage.
• Workload identity: SPIRE on kind (lesson 2.2).
• Secrets: Vault + External Secrets Operator.
• Policy: OPA bundles deployed via OCI; OpenFGA for ReBAC.
• MCP: 2-3 servers signed with cosign; enterprise allow-list service.
• Approval: HITL service from project 4.
• Audit: Loki + Grafana + hash-chained store in S3-compatible MinIO with Object Lock.
• Observability: OpenTelemetry GenAI semconv; Tempo for traces.
• Front-ends: customer dashboard ("My agents"), admin dashboard ("All agents + approvals + audits").

Architecture

       ┌────────────┐
       │   Users    │
       └────┬───────┘
            │  PKCE
            ▼
        ┌──────┐         ┌────────────┐
        │ App  │────────▶│  Keycloak  │
        └──┬───┘         └──────┬─────┘
           │                     │ token exchange
           ▼                     ▼
   ┌──────────────────┐   ┌──────────────────┐
   │ Helpdesk Agent   │   │ Refund Agent     │
   └──────┬───────────┘   └──────┬───────────┘
          │ OBO+DPoP             │ CIBA+RAR+DPoP
          ▼                       ▼
       ┌─────────────────────────────────────┐
       │ Credential Broker  (OPA + Vault)    │
       └──────┬───────────┬───────────┬──────┘
              ▼           ▼           ▼
         GitHub MCP   Notion MCP   payments-api
                  (signed + sandboxed)

   All edges emit audit + decision logs → Loki + S3
   Approvals → HITL service → IdP CIBA + WebAuthn
   Workload identity from SPIRE; SVIDs exchanged for OAuth tokens

Build plan (15 days)

1. Stand up the platform stack (kind + helm: keycloak, vault, spire, opa, openfga, kyverno, loki, grafana, tempo, prometheus).
2. Implement workload identity end-to-end: every pod gets an SVID; broker accepts SVID-based JWT bearer.
3. Build the two agents: helpdesk (read + low-stakes writes) and refund (high-stakes payment writes with HITL).
4. Wire each agent through the broker → MCP servers / payments-api.
5. Integrate HITL approval service for refund agent (full CIBA + WebAuthn flow).
6. Add capability tokens to every high-risk action.
7. Stand up audit pipeline; hash-chain into MinIO Object Lock.
8. Build customer + admin dashboards.
9. Threat model + Agent Cards for both agents.
10. Run a structured red-team exercise on the platform; fix findings.
11. Author governance docs (control matrix, policy bundle, incident runbook).
12. Record demo: install agents, exercise both flows, deliberately try an attack, show audit.

Acceptance criteria

• Both agents work end-to-end through the platform without any static secrets in app code.
• A red-team checklist (lesson 8.1) runs in CI; all attacks blocked or contained.
• An unsigned MCP image cannot be deployed.
• Crypto-shred deletion of a tenant nukes their data + ciphertext, leaving the rest untouched.
• Replaying any captured artefact (token, approval, capability) fails.
• Audit pipeline reconstructs any agent action in < 1 minute.
• Demo video walks through normal use + an attempted attack.

Stretch

• Multi-cluster + multi-region SPIRE federation.
• AI Agent Marketplace UI: list of agents users can install per tenant.
• ISO 42001 / SOC 2 evidence package generated automatically from the control matrix.
• Fully managed migration: swap Keycloak for WorkOS or Auth0 in a feature flag.
• Open-source the platform with a clear "production not included" disclaimer.

Interview talking points

• "Walk me through every credential in the system and where it lives."
• Why workload identity replaces 90% of secret handling.
• How the design defeats a confused-deputy attack.
• The role of HITL vs autonomous action.
• What you'd change to make this multi-region.
• How EU AI Act high-risk obligations map to specific controls you built.
• Total time-to-detect / time-to-respond for a simulated incident.