X3 · Security & Identity

Propagate identity across delegation and constrain each run with least privilege and short-lived credentials.

X3 propagates identity across users, agents, workloads, runs, tools, and resources, then bounds delegation, authorization, and credentials to a concrete capability and environment.

Identity chain

principal → tenant → agent version → workload → session/run
          → intent → approval → short-lived credential → resource

Each hop records who represents whom, which action is allowed, which resource is in scope, and when authority expires. A shared service account identifies a process; it does not prove the user, agent version, or delegation chain behind a request.

Engineering responsibilities

Responsibility	Question	Artifact
Identity	Which principal, tenant, and agent version is active?	Principal, workload identity, run identity
Delegation	What may the downstream agent do on behalf of the upstream principal?	Capability, resource, environment, expiry, non-delegation
Authorization	Should this concrete intent be allowed, denied, or reviewed?	Allow / deny / ask verdict and reason
Credential	How is the verdict enforced by an external system?	Short-lived, narrow, revocable credential

Policy, decision, enforcement, and evidence

A policy source owns rules. A decision service evaluates a structured request. G5 Hooks Pipeline enforces the verdict at unavoidable runtime points. X1 records the request, verdict, state delta, and external receipt. Combining all four in one handler entangles policy versions, runtime identity, and audit boundaries.

Lifecycle

Stage	Security and identity control
Register	Record owner, capability, risk class, tenant, and accessible resources
Design and evaluate	Define least privilege; test overreach, refusal, credential leakage, and cross-tenant cases
Shadow	Use read-only or sandbox identity; constrain rate, amount, batch, and resource scope
Operate	Issue short-lived credentials per intent; revalidate preconditions after resume
Revalidate and retire	Narrow authority after anomalies or regression; revoke old versions and departed principals

Relationship to Governance patterns

G1 binds approval to an intent. G2 sets the impact ceiling. G3 changes the long-term autonomy of a capability. G5 supplies deterministic enforcement points. X3 provides their common identity and authorization foundation while also covering perception data access, memory writes, sub-agent delegation, and publication of reflected assets.

Failure modes

All agents share one long-lived service account;
a role written in a prompt is treated as permission;
approval binds only a prose summary, not tool version, arguments, and resource;
resume reuses expired credentials and stale preconditions;
the user is logged but sub-agent, workload, and delegation identities disappear;
an eval environment can read production secrets or alter release gates.

Public path

The DeerFlow Guardrail case follows identity propagation, providers, decisions, and enforcement points in public code. The Governance workshop records common questions around assembly-time filtering, runtime revalidation, short-lived credentials, and agent lifecycle.

Suggested citation: ADPS, X3 · Security & Identity, ADPS Cross-cutting Engineering Plane Specification v0.5, 20 August 2026.

DeerFlow Guardrail · Governance workshop · CC BY 4.0

Scope: This page defines engineering scope and interfaces; it does not certify products. Attributed practices remain governed by their case pages and public code.