Govern Connectors With Exact Capability Decisions

Enterprise problem: An agent that can call a supplier system can create accounts, upload documents, or change compliance status. A generic connector token turns a narrow workflow step into ambient authority.

Whole-course context: The event path is now reliable. Today places a policy broker and connector broker between agent intent and every external side effect.

Today’s slice: Issue a short-lived capability bound to tenant, run, connector, operation, resource, and argument digest; re-evaluate it immediately before the connector call.

End-of-day evidence: The exact approved call succeeds once; a changed tenant, resource, argument, expired grant, or revoked grant fails closed.

Still unsolved: Deployment identity and environment promotion remain for Day 9; the full failure exercise remains for Day 10.

Use the policy broker application layer in the public monorepo.

export class DecideCapability {
  public constructor(
    private readonly repository: CapabilityRepository,
    private readonly audit: AuditSink,
    private readonly clock: Clock,
    private readonly ids: IdGenerator,
  ) {}

  public async execute(claim: CapabilityClaim): Promise<Decision> {
    const grant = await this.repository.findById(claim.capabilityId);
    const allowed = grant !== null && claimMatchesGrant(claim, grant);
    await this.audit.record({ allowed, capabilityId: claim.capabilityId });
    return { decisionId: `decision_${this.ids.next()}`, allowed };
  }
}

The constructor is the composition seam. Domain matching stays pure, the use case coordinates one decision, and infrastructure is injected through small ports.

Intent is not authority

The model produces data, not a direct network call.

Reject operations outside the connector's declared schema before authorization.

Exact grant

Authority is reduced to one intended effect.

Never derive connector authority from the model session or a broad application role.

Last-mile decision

Policy is checked beside the effect, after arguments are final.

Bind the grant to an argument digest and compare it again at execution time.

Credential isolation

The agent and run orchestrator never receive provider credentials.

Resolve credentials only inside the connector workload with its own IAM role.

Revocable, observable effect

Revocation and evidence use the same precise capability identity.

Fail closed when the grant, tenant, digest, lifetime, or revocation state cannot be proven current.

Run the policy and connector tests, then change one claim dimension at a time. Verify denial for another tenant, another run, another supplier, mutated arguments, expiry, and revocation. Confirm a duplicate idempotency key returns the first result without a second provider effect.

The claim is falsified if the agent observes credentials, a mutated argument succeeds, a revoked grant remains usable, or a duplicate request produces two supplier effects. Passing evidence links the capability, policy decision, redacted request digest, provider receipt, and idempotency result.