{ "format": "agent-article-v0", "article_id": "EA-045", "canonical_url": "/tools/ea-045-extension-research-run-2026-09-28-17-20-jst", "page_type": "reference", "claim_ids": [], "evidence_ids": [ "EVD-EA-045-URL-410B86123707", "EVD-EA-045-URL-BB55030914BE", "EVD-EA-045-URL-DF3B07C07473", "EVD-EA-045-URL-11F2F3599989", "EVD-EA-045-URL-7EA0E25B2395", "EVD-EA-045-URL-E6D19CB5649A", "EVD-EA-045-URL-A10EBDAE144A", "EVD-EA-045-URL-BB7064E0DDAD", "EVD-EA-045-URL-1FB7FD98AE59", "EA-045-R11-RESEARCH", "EA-045-R11-WEB-READBACK" ], "unknown_ids": [ "EA-045-UNKNOWN-01", "EA-045-UNKNOWN-CURRENTNESS" ], "operational_object_ids": [], "provider": [], "models": [], "plans": [], "surfaces": [], "regions": [], "current_status": "UNKNOWN", "observation_status": "SPEC_ONLY", "freshness": "UNKNOWN", "last_verified": null, "supersedes": [], "superseded_by": [], "provenance": [ "LIB-EA0045-20260928", "SRC-EA-045-URL-410B86123707", "SRC-EA-045-URL-BB55030914BE", "SRC-EA-045-URL-DF3B07C07473", "SRC-EA-045-URL-11F2F3599989", "SRC-EA-045-URL-7EA0E25B2395", "SRC-EA-045-URL-E6D19CB5649A", "SRC-EA-045-URL-A10EBDAE144A", "SRC-EA-045-URL-BB7064E0DDAD", "SRC-EA-045-URL-1FB7FD98AE59", "WEBBODY-EA0045-R8-D28F2860" ], "article_sources": [ { "id": "EVD-EA-045-URL-410B86123707", "evidence_class": "RESEARCH", "title": "https://datatracker.ietf.org/doc/html/rfc8693", "href": "https://datatracker.ietf.org/doc/html/rfc8693", "supports": [], "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。", "origin_class": "SOURCE_PACKET_REFERENCE", "source_or_experiment_ids": [ "SRC-EA-045-URL-410B86123707" ], "supporting_locators": [ "EVIDENCE TABLE", "https://datatracker.ietf.org/doc/html/rfc8693" ], "scope": "EVIDENCE TABLE", "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED" }, { "id": "EVD-EA-045-URL-BB55030914BE", "evidence_class": "RESEARCH", "title": "https://spiffe.io/docs/latest/spiffe-specs/spiffe_workload_api/", "href": "https://spiffe.io/docs/latest/spiffe-specs/spiffe_workload_api/", "supports": [], "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。", "origin_class": "SOURCE_PACKET_REFERENCE", "source_or_experiment_ids": [ "SRC-EA-045-URL-BB55030914BE" ], "supporting_locators": [ "EVIDENCE TABLE", "https://spiffe.io/docs/latest/spiffe-specs/spiffe_workload_api/" ], "scope": "EVIDENCE TABLE", "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED" }, { "id": "EVD-EA-045-URL-DF3B07C07473", "evidence_class": "RESEARCH", "title": "https://spiffe.io/docs/latest/deploying/svids/", "href": "https://spiffe.io/docs/latest/deploying/svids/", "supports": [], "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。", "origin_class": "SOURCE_PACKET_REFERENCE", "source_or_experiment_ids": [ "SRC-EA-045-URL-DF3B07C07473" ], "supporting_locators": [ "EVIDENCE TABLE", "https://spiffe.io/docs/latest/deploying/svids/" ], "scope": "EVIDENCE TABLE", "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED" }, { "id": "EVD-EA-045-URL-11F2F3599989", "evidence_class": "RESEARCH", "title": "https://developer.hashicorp.com/vault/tutorials/get-started/understand-static-dynamic-secrets", "href": "https://developer.hashicorp.com/vault/tutorials/get-started/understand-static-dynamic-secrets", "supports": [], "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。", "origin_class": "SOURCE_PACKET_REFERENCE", "source_or_experiment_ids": [ "SRC-EA-045-URL-11F2F3599989" ], "supporting_locators": [ "EVIDENCE TABLE", "https://developer.hashicorp.com/vault/tutorials/get-started/understand-static-dynamic-secrets" ], "scope": "EVIDENCE TABLE", "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED" }, { "id": "EVD-EA-045-URL-7EA0E25B2395", "evidence_class": "RESEARCH", "title": "and", "href": "https://developer.hashicorp.com/vault/docs/secrets/databases", "supports": [], "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。", "origin_class": "SOURCE_PACKET_REFERENCE", "source_or_experiment_ids": [ "SRC-EA-045-URL-7EA0E25B2395" ], "supporting_locators": [ "EVIDENCE TABLE", "and https://developer.hashicorp.com/vault/docs/secrets/databases" ], "scope": "EVIDENCE TABLE", "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED" }, { "id": "EVD-EA-045-URL-E6D19CB5649A", "evidence_class": "RESEARCH", "title": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/identity-idps.html", "href": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/identity-idps.html", "supports": [], "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。", "origin_class": "SOURCE_PACKET_REFERENCE", "source_or_experiment_ids": [ "SRC-EA-045-URL-E6D19CB5649A" ], "supporting_locators": [ "EVIDENCE TABLE", "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/identity-idps.html" ], "scope": "EVIDENCE TABLE", "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED" }, { "id": "EVD-EA-045-URL-A10EBDAE144A", "evidence_class": "RESEARCH", "title": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-outbound-auth.html", "href": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-outbound-auth.html", "supports": [], "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。", "origin_class": "SOURCE_PACKET_REFERENCE", "source_or_experiment_ids": [ "SRC-EA-045-URL-A10EBDAE144A" ], "supporting_locators": [ "EVIDENCE TABLE", "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-outbound-auth.html" ], "scope": "EVIDENCE TABLE", "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED" }, { "id": "EVD-EA-045-URL-BB7064E0DDAD", "evidence_class": "RESEARCH", "title": "https://datatracker.ietf.org/doc/html/draft-hartman-credential-broker-4-agents-00", "href": "https://datatracker.ietf.org/doc/html/draft-hartman-credential-broker-4-agents-00", "supports": [], "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。", "origin_class": "SOURCE_PACKET_REFERENCE", "source_or_experiment_ids": [ "SRC-EA-045-URL-BB7064E0DDAD" ], "supporting_locators": [ "EVIDENCE TABLE", "https://datatracker.ietf.org/doc/html/draft-hartman-credential-broker-4-agents-00" ], "scope": "EVIDENCE TABLE", "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED" }, { "id": "EVD-EA-045-URL-1FB7FD98AE59", "evidence_class": "RESEARCH", "title": "https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/", "href": "https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/", "supports": [], "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。", "origin_class": "SOURCE_PACKET_REFERENCE", "source_or_experiment_ids": [ "SRC-EA-045-URL-1FB7FD98AE59" ], "supporting_locators": [ "EVIDENCE TABLE", "https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/" ], "scope": "EVIDENCE TABLE", "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED" }, { "id": "EA-045-R11-RESEARCH", "evidence_class": "RESEARCH", "title": "EA-045 監査済みresearch / canonical revision binding", "supports": [ "F1 \\[RESEARCH\\]: Credential\nBrokerは単一の既存標準名として固定できない。実装可能なvendor-neutral\npatternは、(a) workload/agent identity、(b) delegation/authorization\ndecision、(c) secret/dynamic credential store、(d) short-lived\nissuance/token exchangeまたはbroker-side injection、(e) target-bound\negress、(f) issuance/use/revocation auditを分離する構成である。" ], "limit": "canonical監査・revision bindingの存在を示す。外部ソースcurrentnessが本文またはcontrol-planeで確定していない場合は、currentnessをUNKNOWNのまま保持する。", "origin_class": "AUDITED_CANONICAL_RESEARCH_PACKET", "source_or_experiment_ids": [ "LIB-EA0045-20260928" ], "supporting_locators": [ "LIB-EA0045-20260928", "EA-045-R5-LEGACY-MIGRATION-20261008-R1", "content/staging/EA-045.md" ], "scope": "監査済みEA本文・canonical revision・既存Source Graph relationの範囲。欠損currentnessは推測で閉じない。", "provenance_status": "AUDIT_PASS_CANONICAL_BINDING" }, { "id": "EA-045-R11-WEB-READBACK", "evidence_class": "IMPL", "title": "EA-045 Web body identity / canonical readback", "supports": [ "canonical staging bodyのSHA-256一致とR9 canonical ledger readbackをProduction projectionの入力として検証する。" ], "limit": "body identity/readbackは本文claim自体の真偽や外部ソースの最新性を追加保証しない。", "checked_at": null, "origin_class": "IMPLEMENTATION_READBACK", "source_or_experiment_ids": [ "WEBBODY-EA0045-R8-D28F2860" ], "supporting_locators": [ "WEBBODY-EA0045-R8-D28F2860", "content/staging/EA-045.md", "EA-045-R5-LEGACY-MIGRATION-20261008-R1" ], "scope": "R9/R10 canonical readback後のProduction生成時body identity。", "provenance_status": "CANONICAL_READBACK_BODY_HASH_MATCH" } ], "research_sections": [ { "heading": "WHY_THIS_MATTERS_TO_UPDATE", "text": "Agent/LLM実行系へ長期API key、OAuth refresh\ntoken、database\npassword等を直接渡す設計は、prompt/tool/log/contextへの露出、共有資格情報による帰属不能、失効・rotation遅延、過剰権限を生みやすい。Credential\nBrokerは「agent identity」「authorization/delegation」「credential\nmaterial」「egress/tool\nexecution」を分離し、必要時だけ短命・限定credentialを発行またはbroker側で注入する統制点として整理する価値がある。" }, { "heading": "SCOPE_ROUTING", "text": "COMMON_CORE / IDENTITY+AUTHORIZATION / SECURITY / AUDIT /\nOPERABILITY。EA-043 Agent Identity、EA-044 Delegated\nAuthorization、EA-046 AI Gatewayと隣接するが、EA-045はcredential\nlifecycleとsecret non-disclosureを主対象とする。" }, { "heading": "CLAIM_OR_RESEARCH_QUESTION", "text": "AI agent向けCredential\nBrokerをvendor-neutralに定義する際、どこまでを既存workload\nidentity、OAuth token exchange/delegation、secrets manager/dynamic\ncredential、agent product実装で裏付けられるか。特定製品の「agent\ncredential broker」機能を一般標準と誤認しないためのfailure\nenvelopeは何か。" }, { "heading": "EVIDENCE TABLE", "text": "1. official standard --- RFC 8693, *OAuth 2.0 Token Exchange*, IETF,\n 2020, access 2026-09-28,\n https://datatracker.ietf.org/doc/html/rfc8693, VERIFIED_SPEC, token\n exchange / delegation-vs-impersonation semantics.\n2. official specification --- SPIFFE Workload API / SVID documentation,\n SPIFFE, current docs accessed 2026-09-28,\n https://spiffe.io/docs/latest/spiffe-specs/spiffe_workload_api/ and\n https://spiffe.io/docs/latest/deploying/svids/, VERIFIED_SPEC,\n workload identity and short-lived X.509/JWT SVID delivery.\n3. author-maintained product documentation --- HashiCorp Vault,\n *Understand static and dynamic secrets* / *Database secrets engine*,\n accessed 2026-09-28,\n https://developer.hashicorp.com/vault/tutorials/get-started/understand-static-dynamic-secrets\n and https://developer.hashicorp.com/vault/docs/secrets/databases,\n VERIFIED_SPEC / PRODUCT_VOLATILE, dynamic credential generation,\n leases and revocation.\n4. provider official documentation --- Amazon Bedrock AgentCore\n Identity, provider setup / outbound authorization, AWS, accessed\n 2026-09-28,\n https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/identity-idps.html\n and\n https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-outbound-auth.html,\n PRODUCT_VOLATILE, managed inbound/outbound OAuth credential-provider\n implementation.\n5. standards-development primary source --- *Credential Broker for\n Agents (CB4A)*, draft-hartman-credential-broker-4-agents-00, IETF\n Internet-Draft, 2026,\n https://datatracker.ietf.org/doc/html/draft-hartman-credential-broker-4-agents-00,\n RESEARCH, emerging design evidence only; not an RFC/standard.\n6. independent security research --- Palo Alto Networks Unit 42, *The\n Machine With Many Faces: Post-Exploitation Identity Misuse in\n SPIFFE/SPIRE*, 2026-09, accessed 2026-09-28,\n https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/,\n SOURCE_REPORT, counterevidence/failure envelope for\n attestation/selector compromise." }, { "heading": "FINDINGS", "text": "F1 \\[RESEARCH\\]: Credential\nBrokerは単一の既存標準名として固定できない。実装可能なvendor-neutral\npatternは、(a) workload/agent identity、(b) delegation/authorization\ndecision、(c) secret/dynamic credential store、(d) short-lived\nissuance/token exchangeまたはbroker-side injection、(e) target-bound\negress、(f) issuance/use/revocation auditを分離する構成である。\n\nF2 \\[VERIFIED_SPEC\\]: RFC 8693はtoken\nexchangeにおけるdelegationとimpersonationを区別する。agentがuserを代表して動く場合、actor\nidentityを消してuser\nimpersonationだけにする設計と、actorを保持したdelegationは監査意味が異なる。Credential\nBrokerはこの差をcredential issuance recordへ保持すべきである。\n\nF3 \\[VERIFIED_SPEC\\]: SPIFFEはworkloadがWorkload\nAPIからSVIDを取得する標準面を提供する。これは「agentが外部SaaSのcredentialを取得するbroker」そのものではなく、brokerへ提示するworkload\nidentityの一候補である。\n\nF4 \\[VERIFIED_SPEC/PRODUCT_VOLATILE\\]: Vaultのdynamic secretsはon-demand\ncredential、lease、TTL、revocationというcredential lifecycle\nprimitiveを提供する。一方、static secret retrievalではcredential\nmaterialがclientへ渡る構成もあり得るため、「Vaultを使えばmodel/agentがsecretを見ない」は一般化できない。\n\nF5 \\[PRODUCT_VOLATILE\\]: Amazon Bedrock AgentCore Identityはmanaged\nOAuth providerとoutbound authorization/credential\nproviderを提供している。これはCredential Broker\npatternの現行provider実装例であり、全provider/plan/region/tenantで同じ機能がある証拠ではない。\n\nF6 \\[RESEARCH\\]: 2026年のCB4A Internet-DraftはSPIRE/SPIFFE\nidentity、task request envelope等をCredential Broker for\nAgentsとして提案しているが、Internet-Draftであり標準化完了を意味しない。将来仕様の方向性を示すcounterpartとしてのみ扱う。" }, { "heading": "LIMITS / COUNTEREVIDENCE / FAILURE ENVELOPE", "text": "- Brokerがsecretを保持していても、最終的にcredential valueをagent\n processへ返す設計ならcontext/log/tool\n subprocessへの漏洩面は残る。可能ならbroker-side injection/proxy\n executionとcredential non-disclosureを区別する。\n- short-lived credentialはstolen\n credentialの有効時間を短縮するが、発行時のidentity/authorizationが誤っていれば誤権限を短時間で正当化するだけである。\n- SPIFFE/SPIREはidentity primitiveでありauthorization policyやupstream\n SaaS scopeを自動的に正しくしない。attestation/selector\n compromiseやpost-exploitation identity misuseをfailure\n envelopeへ含める。\n- OAuth\n scopeが細粒度でないproviderではbroker側policyが細かくてもupstream\n tokenのblast radiusを十分に縮められない場合がある。\n- static API\n keyしか提供しないupstreamでは「短命credentialをmintする」ことが不可能な場合があり、broker-side\n injection、target pinning、request\n policy、rotationで代替する必要がある。\n- token exchange、delegation、impersonation、service/workload\n identityを同義語として扱わない。\n- broker自身は高価値な集中攻撃面になる。root/admin\n credential、encryption key、policy administration、audit\n logの分離とbreak-glass統制が必要。\n- product\n documentationは特定tenantでのentitlement、region、policy、retention、実際のaudit\n completenessを証明しない。" }, { "heading": "AVAILABILITY_GATES", "text": "provider/product、plan/contract、region、organization/tenant\npolicy、IdP/authorization-server integration、supported credential\ntype、OAuth grant/token-exchange support、target API scope\ngranularity、Secrets Manager/Vault integration、agent runtime/network\negress mode、preview/GA state、as-of dateを分離する。" }, { "heading": "IMPLEMENTATION_STATE", "text": "PATTERN_SUPPORTED / PRODUCT_IMPLEMENTATIONS_EXIST /\nUNIVERSAL_STANDARD_NOT_ESTABLISHED。RFC\n8693・SPIFFE・Vault等の既存primitiveで構成可能であり、AWS\nAgentCore等にagent向けmanaged\nimplementationが存在する。一方、CB4AはInternet-Draft段階であり、共通agent\ncredential broker標準として確定扱いしない。" }, { "heading": "BENCHMARK_OR_EVAL", "text": "安全なTEST_PROFILE（未実施）: 1. agent/workload\nA/Bを別identityで作成し同一target credentialへのgrant差を検証。 2.\nbrokerがcredential\nvalueをagent/model/logへ返さないmodeと返すmodeを区別して観測。 3.\ntoken/lease TTL、audience、scope、target binding、revocation\npropagationを測定。 4. user-delegated actionではsubject/actor\nchainがaudit evidenceへ残るか確認。 5. denied request、expired\ncredential、revoked grant、wrong audience、cross-agent replayをnegative\ntest。 6. static-key-only upstreamではbroker\nproxy/injectionのhost/path/method pinningを検証。\n認証済みtenantや課金環境への危険なlive testは本RUNでは実施しない。" }, { "heading": "SECURITY", "text": "model contextへcredential valueを入れない。identity\nproofとauthorization\ndecisionを分離し、credentialをaudience/target/scope/TTLへbindする。broker\nadmin planeをagent runtimeから分離する。 PRIVACY:\ncredentialそのものに加えOAuth refresh token、delegation\nsubject、resource identifiers、audit metadataをsensitive\ndataとして扱う。 AUDIT: requester workload/agent identity、human\nsubject（該当時）、delegation/impersonation semantics、policy\ndecision、credential\nreference/type、target、scope、TTL、issuance/use/revocation/resultを相関可能にする。secret\nvalueはauditへ記録しない。 COST: broker hop、token exchange、vault\noperations、audit retentionによるlatency/costを計測し、security\ncontrolを理由に無制限retryしない。 OPERABILITY: expiry/refresh\nrace、clock skew、provider outage、revocation delay、secret\nrotation、broker HA、break-glass、policy rollbackを運用対象にする。" }, { "heading": "SAFE_WORDING_FOR_FUTURE_BOOK", "text": "AI Credential\nBrokerは、agentへ長期credentialを配布する仕組みではなく、agent/workload\nidentityとauthorizationを確認したうえで、必要なtarget・scope・期間に限定したcredentialを発行・交換する、またはbroker側でcredentialを注入して代理実行する統制パターンとして扱う。SPIFFE、OAuth\nToken\nExchange、Vault等は構成primitiveであり、いずれか一つを導入しただけでagent\ncredential isolationが成立するとは限らない。製品固有のmanaged\nidentity/credential\nproviderはplan・region・tenant設定・as-ofを別途確認する。" }, { "heading": "UPDATE_WORK_HANDOFF", "text": "1. EA-043 Agent Identityからverified workload\n identityを入力として受ける。\n2. EA-044 Delegated Authorizationからsubject/actor/delegation\n semanticsを受ける。\n3. EA-045では credential reference → policy decision →\n issuance/injection → target call → revocation/audit\n のlifecycleを正本化する。\n4. EA-046 Gatewayとは「credential policy/secret\n boundary」と「traffic/tool routing\n boundary」を分離し、同一製品でも論理面を混同しない。\n5. provider mappingではAWS AgentCore等をimplementation\n exampleとして扱い、common Coreへ逆一般化しない。\n6. CB4Aが更新・標準化された場合はVERSION_REFRESHする。" }, { "heading": "UNKNOWN", "text": "CB4A後続draft/標準化の行方、providerごとのtoken-exchange/RAR/delegation\nsupport、AgentCore等のplan/region/tenant\nentitlement、各providerのcredential non-disclosure保証範囲、revocation\npropagation実測、independent production\nevidence、organization固有break-glass/retention要件。" }, { "heading": "STOP_CONDITION", "text": "EA-045は、既存packet所在確認が未成功であることを保持したうえで、primary/author-maintained\nevidenceによるbounded\nbackfillを完了した。今後は同一内容のフル再研究を行わず、canonical\nsync、CB4A/製品更新時のVERSION_REFRESH、独立実運用または安全なTEST_PROFILE追加時のSUPPLEMENT_ONLYとする。\n\n---" }, { "heading": "AUDITED_BOUNDARY", "text": "Credential Broker is a vendor-neutral control pattern assembled from identity, authorization/delegation, credential lifecycle, target-bound execution and audit primitives; it is not an established universal agent standard. CB4A remains Internet-Draft -00 and its text states Expires 30 September 2026; official Datatracker current page was rechecked on 2026-09-30 and must be treated as work in progress, not an RFC/standard. Preserve SPIFFE/Vault/AWS implementation boundaries and all OPEN_UNKNOWN." } ], "human_url": "/tools/ea-045-extension-research-run-2026-09-28-17-20-jst", "markdown_url": "/agent/article.md?path=%2Ftools%2Fea-045-extension-research-run-2026-09-28-17-20-jst", "json_url": "/agent/article.json?path=%2Ftools%2Fea-045-extension-research-run-2026-09-28-17-20-jst" }