« Phase 08 · Warmup · Track Overview

Lab 01 — The Identity Fabric

The problem

A relationship manager asks a question in Teams. An orchestrator agent takes it, delegates to a payments-investigation agent, which calls core banking to read a payment.

Three hops. At the last one, core banking must be able to answer: who is doing this, on whose behalf, with what authority, and can I prove it?

The tempting answer is a service account with the union of every permission any agent might need. It works on day one and it is the finding an examiner writes up: every action is attributed to "the platform", nothing is bounded by what the user may do, and a leaked credential is permanent and unlimited.

You build the alternative: credentials that are derived from a verified assertion, narrowed at every hop, chained so the whole path is visible, and short-lived enough that revocation is a timeout rather than a process.

What you build

Key concepts

Files

Run

pip install -r requirements.txt
pytest test_lab.py -v
LAB_MODULE=solution pytest test_lab.py -v
python solution.py

Success criteria

• All 104 tests green against your lab.py.
• Base64url round-trips for every padding case, and emits no =.
• A token whose header says alg: none is refused with invalid_alg.
• A token minted for another audience is refused — even with a valid signature.
• Clock skew is tolerated in both directions, and has a limit.
• act nests with the most recent actor outermost, and round-trips earliest-first.
• narrow_scopes can never return a scope outside held, for any input.
• PKCE is mandatory, S256 only, and a plain challenge raises.
• An authorization code is single-use, exact-redirect-matched, and client-bound.
• An exchange that does not narrow the audience is refused.
• An agent already in the chain — or the user itself — cannot be appended.
• A derived token never outlives its parent, even when a longer life is requested.
• Attestation with a subset of the registered selectors fails.
• Two matching registration entries produce ambiguous_attestation, not a guess.
• A suspended identity cannot receive a credential.
• A token bound to a key is useless without it.

How this maps to the real stack

Honest limits. No asymmetric signing, so nothing here exercises key distribution — which is most of the operational work. No refresh tokens, and therefore no refresh-token rotation or reuse-detection, which is where a lot of OAuth 2.1's remaining subtlety lives. No revocation list — the lab's revocation is expiry plus registry state, which is the right default and not the whole story. And the delegation chain is carried in a claim; a real deployment must also decide what happens when a hop crosses into a system that cannot read it.

Extensions

1. Asymmetric signing and a JWKS endpoint. Then rotate the key with an overlap window and watch which of your tests break. Key rollover is where identity systems actually fail.
2. Refresh tokens with rotation and reuse detection. A reused refresh token means it was stolen; the correct response is to revoke the whole family. Implement it and test the race.
3. DPoP (RFC 9449). Replace the lab's cnf thumbprint with a real proof-of-possession: a signed JWT per request, with a nonce and replay protection.
4. Continuous authorization. Re-verify mid-task (Phase 09): the user's entitlements change while a four-hour task is parked. What must interrupt?
5. A revocation channel. Suspension currently takes effect at the next credential request. Add a kill switch that beats the TTL, and decide what it costs you in availability.
6. Cross-domain federation. Two SPIRE trust domains with a federation bundle. What must be re-verified rather than trusted?
7. The parked-task problem. A task waiting four hours for an approval outlives every sensible credential. Implement the correct shape: hold a reference, re-mint on resume, re-evaluate policy at that moment.

Interview / resume bullets

• "Built the platform's agent identity model: every credential is derived from a verified assertion via RFC 8693 token exchange, narrowed in audience and scope at each hop, appended to an unforgeable delegation chain, and issued with a lifetime of seconds — so core banking can see that user U asked, orchestrator O delegated, and agent A acted."
• "Replaced shared service accounts with SPIFFE-style workload identity: the platform attests verifiable properties of a running workload and issues a short-lived SVID, which removed long-lived secrets from the agent fleet entirely."
• "Made privilege escalation structurally impossible in the exchange path — the narrowing function cannot return a scope it was not given — and made silent under-granting an error rather than a surprise."
• "Implemented an NHI lifecycle with a mandatory human owner and a declared state machine, so 'which agents exist, who owns them, and are they still needed' became a query rather than an investigation."