@EItanya @peterj PTAL

@dimetron PTAL?

The proposal picks the right engine (CEL) and reuses the existing
auth.Authorizer.

What's good (approve)

• CEL is the right engine. It runs in-process, it is sandboxed and guaranteed to
  terminate, it evaluates in microseconds, and cel-go is already in the module
  graph, so it adds no new single point of failure.
• It keeps auth.Authorizer as the extension seam, so the external OPA option
  (External auth init #1370) stays a drop-in.
• Compiling policy at reconcile time into a generation-keyed cache, with a lazy
  fallback on cache miss, is the right pattern for a controller.
• The default path is fail-closed, opt-in, and backward compatible, and a bad
  policy shows up on status.conditions as AccessPolicyValid.
• It builds on the stalled prototypes (feat: group-based agent authorization via OIDC groups claim #1766 for list filtering and the A2A
  gate, External auth init #1370 for the external authorizer) instead of starting over.
• The non-goals and alternatives are honest. Casbin, OPA-only, a bespoke DSL,
  and SubjectAccessReview each get dismissed with a real reason.

What he missed (must address before accepted)

1. Coverage is overstated. The EP says authz is "wired into every handler
   (~25 call sites)", but only about 8 of the ~22 handler areas gate anything
   today. Sessions, memory, tasks, model-provider config, companion secrets, and
   A2A invoke are all ungated, and those are the most sensitive surfaces. The EP
   needs an honest coverage matrix (below) and a commitment to close them.
2. M2M and agent calls carry no claims, so a fail-closed claims-based policy
   would deny all internal A2A traffic. That is a blocker, not an open question.
   The cleanest fix is workload identity (see below), which also removes the
   spoofable X-Agent-Name header the agent path trusts today.
3. Policy combining is left as UNRESOLVED, but it is core semantics and nothing
   can be implemented without it. Pin it down: default-deny, allow if either the
   central policy or the matching per-resource policy permits, and only consult
   a per-resource policy for its own resource. That last rule is what
   structurally guarantees the widen-only invariant, so the EP should say so.
4. There is no invoke verb. A2A invocation collapses onto get, so a policy
   cannot tell "may read" apart from "may run". Add VerbInvoke.

M2M: use workload identity, keep one policy model

Today the agent path identifies the caller from the unverified X-Agent-Name
header and sets no claims. Instead, let the M2M caller present a verified
identity token and bind it into the principal. Any of these works, in order of
how native they are to the stack:

• A Kubernetes projected ServiceAccount token, with sub
system:serviceaccount:<ns>:<sa>, audience-bound to kagent.
• A SPIFFE JWT-SVID, with sub spiffe://<trust-domain>/ns/<ns>/sa/<sa>.
• Istio's default mTLS (X.509-SVID), where the sidecar forwards the peer SPIFFE
  ID in the X-Forwarded-Client-Cert header.

The authorizer then populates Principal.Claims and Principal.Agent.ID from
that verified identity, so the same CEL model covers humans and machines with no
separate lane:

// SPIFFE JWT-SVID
claims.sub == "spiffe://kagent.local/ns/kagent/sa/agent-runner"

// or a projected Kubernetes ServiceAccount token
claims.sub == "system:serviceaccount:kagent/agent-runner"

This resolves the M2M blocker and the spoofable-header risk at once. Keep it
simple in the first cut: pick one carrier (projected SA token is the most
native), verify the audience, parse the identity into structured fields once,
and leave on-behalf-of user delegation (#2071 / STS) for later. Workload
identity tells you which agent called, not on whose behalf.

Enforcement model: middleware vs per-handler (root cause of gap #1)

The coverage gap is not really "14 handlers forgot a check". It is the
enforcement model. Authz today is opt-in per handler, with Check() scattered
across 8 files, which makes it default-open: any route without a Check() call
is silently a bypass. A one-time audit fixes today's snapshot, but it rots the
moment someone adds a route.

Recommendation: add a deny-by-default authz middleware as the backstop, and keep
per-handler Check() for the cases the middleware cannot cover. A route that is
not explicitly mapped to a (resourceType, verb) is denied.

This fits the code as it stands:

• The server already runs a middleware chain (s.router.Use(...)) with an
  AuthnMiddleware sibling, so an AuthzMiddleware slots in right after it
  (go/core/internal/httpserver/server.go:356-360).
• Routes use gorilla/mux with {namespace} and {name} vars, so the middleware
  can read the resource name and namespace from mux.Vars(r) and the verb from
  the HTTP method (the same switch handlers.Check already uses).

What stays in the handler, because the middleware cannot do it:

This needs two pieces: a declarative registry that maps each route to its
resource type, verb, and whether it is public, and an explicit public allowlist
(/health, /version, and the self-scoped /api/user) so probes and
self-calls keep working.

Why it is worth the refactor: a missing registry entry fails closed (the request
is denied), whereas a missing Check() today fails open (the request goes
through). That asymmetry is the whole reason to do it. The same middleware also
covers the A2A PathPrefix handler (server.go:347) instead of leaving it to a
separate hand-wired gate. The EP should state this enforcement-model choice
explicitly rather than inheriting the implicit per-handler one.

Smaller suggestions

• Keep authorizer set to noop whenever auth.mode=unsecure. Dev clusters
  have no claims, so a claims-based policy would lock them out.
• Add Namespace to auth.Resource, or normalize it once inside the
  authorizer, so handlers stop re-parsing namespace/name.
• Add an observability section: decision metrics
  (kagent_authz_decisions_total{result,resource_type},
  kagent_authz_config_valid) and deny logging at V(1) that never prints
  claim values.
• Add a threat-model and trust-boundary paragraph. The proxy validates the JWT
  and the controller trusts the proxy. List what authz does not cover (direct
  pod access in Secure the kagent UI #2028, and the ungated endpoints).
• Add break-glass and bootstrap-admin guidance so turning authz on against a
  live cluster does not lock everyone out.
• Note that the Casbin sections in EP-476 are superseded by EP-1270.
• Note the size limits: a CEL string in spec.accessPolicy counts against the
  etcd object limit, the central ConfigMap is capped at 1 MiB, and the
  compiled-program cache currently only evicts on delete.

Authorization gates matrix

Verified against main by counting Check() and authorizeAgentRequest calls
per handler file in go/core/internal/httpserver/handlers.

Summary: about 8 of the ~22 handler areas gate authz today, all of them CRUD on
Agent, ModelConfig, ToolServer, and PromptTemplate. The other half includes the
most sensitive surfaces: sessions, memory, companion secrets, model-provider
config, and A2A invoke. Turning on CELAuthorizer without the coverage work
leaves those as bypass paths, which is why the "wired into every handler" line
has to become a real coverage matrix and a scope commitment.

Bottom line

The direction is right: CEL as the default behind the existing interface. Merge
it as provisional. Before it moves to accepted:

1. Replace the coverage claim with the matrix above, commit to closing the
   sensitive gaps, and adopt a deny-by-default authz middleware (hybrid with
   per-handler Check()) so the gap cannot come back.
2. Move M2M principals and policy combining out of "Open Questions" and into
   resolved design. For M2M, adopt verified workload identity (projected SA
   token or SPIFFE) bound into the principal, not the X-Agent-Name header.
3. Add the observability and threat-model sections.

References

Related PRs and issues:

• #1766: per-agent
  kagent.dev/allowed-groups annotation, GroupAuthorizer, agent-list
  filtering, and A2A request gating (stalled on inactivity).
• #1370: pluggable external
  authorizer (OPA-style webhook) behind the Authorizer interface (stalled).
• #1293: OIDC proxy
  authentication (EP-476), which added the trusted-proxy mode this EP builds on.
• #2071: STS and delegated
  identity, relevant to propagating caller claims on the agent path.
• #2028: network gating
  (HTTPRoute, NetworkPolicy, OpenShift Route), the out-of-scope edge controls.

Source locations (verified against main):

• NoopAuthorizer.Check returns nil: go/core/internal/httpserver/auth/authz.go.
• Authorizer interface, the Verb set (get/create/update/delete),
  Resource{Name, Type} with no Namespace field, and Principal.Claims:
  go/core/pkg/auth/auth.go (Verb at lines 9-16, Resource at 18-21,
  Principal at 32-36).
• Central Check helper and the HTTP-method-to-verb switch:
  go/core/internal/httpserver/handlers/helpers.go:56-80.
• Middleware chain, where an AuthzMiddleware would sit next to
  AuthnMiddleware: go/core/internal/httpserver/server.go:356-360.
• A2A registered as a PathPrefix handler with authentication only, no
  authorizer: go/core/internal/httpserver/server.go:347.
• cel-go already in the module graph (indirect today, promote to direct when
  implementing): go/go.mod.
• Agent status conditions, where AccessPolicyValid would be reported:
  go/api/v1alpha2/agent_types.go.