Connector Credentials and Workload Identity

Enterprise problem: A customer needs scheduled agents to reach enterprise systems, but a creator’s refresh token or a broad key can outlive that person, cross team boundaries, and turn one compromised run into standing access.

Whole-course context: Days 07-08 produced an immutable agent binding and separated preview/application data from provider authority; today provisions a machine-owned connector grant before on-behalf-of access is introduced.

Today’s slice: Provision the machine or service grant first, bind it to one team and deployment, and only then distinguish optional user-delegated access; generated-application users and data remain a separate plane.

End-of-day evidence: A reviewer receives one successful scheduled-call envelope and one revoked or wrong-team denial envelope, each tied to an immutable decision and trace identifier.

Still unsolved: Per-tool argument checks, resource-specific Model Context Protocol (MCP) token exchange, human approval, and agent-to-agent delegation remain for later slices.

Thesis: Unattended automation should authenticate as running software and receive narrowly brokered downstream authority; it should never become a container for a creator's reusable credential.

The smallest complete model gives Northstar's HelixWorks Supplier Onboarding Agent a stable team-owned service grant, lets an attested workload request it, and allows a credential broker to deliver only the transient authority needed for one connector call. The workload identity proves which software is asking; the service grant and current policy decide what that software may do.

The customer outcome is a reliable, reviewable implementation of 03 connector credentials workload identity. This day introduces the mechanism before policy detail and evidence review; it does not repeat the same customer stories in prose, tables, and diagrams.

Authorization policy service owns decisions; the connector/runtime gateway owns enforcement. Compute: API and isolated worker processes. Storage: PostgreSQL is authoritative for grants and state; Redis is a versioned cache; vault owns secrets; object storage retains redacted evidence only.

Implement the day’s boundary with a current, explicit decision before privileged compute or a downstream call. Bind every effect to a tenant, subject or workload, deployment, resource, and short-lived evidence ID; a cache or model response never grants authority.

Credential architecture trades simple automation against concentration of authority; ignoring the trade-off either breaks schedules during personnel changes or creates a service principal with excessive reach. Decide first who owns the downstream grant, then how narrowly the platform can broker it.

A configured connection is not evidence that the runtime cannot steal or misuse it; without observed allow, wrong-team, rotate, and revoke paths, the trust boundary remains hypothetical. Build the Campaign connector in dependency order and verify both metadata and data flow.

1. Provision stable service:marketing-automation under the Marketing team and publish its exact workload subject and audience.
2. Let Acme authorize the least-privilege source principal; store the refresh credential or key only in the vault and retain an opaque secret reference in the binding.
3. Record provider tenant, scopes, resources, consent version, expiry, status, and owner; require scope to be a subset of connector policy.
4. Bind the connector instance and enabled tools to deploy_marketing_prod; freeze that relationship with the deployment version.
5. Start a Campaign scheduled run with workload identity and a short-lived run token; ask the broker for the selected binding rather than a caller-supplied secret.
6. Deliver a transient access token directly to the connector adapter, call the provider, discard token material, and seal provider request, decision, and trace IDs.
7. Rotate and revoke through idempotent lifecycle jobs; invalidate caches and run fresh probes after each transition.

Minimum acceptance matrix:

The design only protects Acme when the scheduled Campaign path succeeds without human credentials and fails before secret retrieval for the wrong tenant or revoked binding. Provision one least-privilege Marketing service grant, run the six probes, and make their sealed envelopes a deployment prerequisite.

The claim is falsified if Alice's credential is required for the schedule, a Sales or untrusted workload reaches the vault, a retired binding mints a new token, or any agent-visible surface contains credential material. The deliverable is one observable evidence bundle linking service principal, workload attestation, connector and binding versions, vault-access decision, provider request, rotation/revocation jobs, paired allow/deny traces, and the unaffected positive control.

Inspect the credential boundary in services/connector-broker/src/ports.ts:

export interface SupplierGateway {
  execute(input: {
    readonly tenantId: TenantId;
    readonly credentialReference: string;
    readonly operation: SupplierOperation;
    readonly signal: AbortSignal;
  }): Promise<SupplierExecutionResult>;
}

Northstar's run passes an opaque aws-sm:// reference, never secret bytes. The connector adapter interprets it and resolves credentials out of process; application state retains only the reference; network and CPU are used only after authorization; a provider request ID plus a secret-canary scan proves the boundary. The port applies IoC/DI: the use case does not depend on AWS Secrets Manager. That gives orchestration one responsibility (SRP) and lets local and AWS adapters reuse the contract (DRY).

pnpm --filter @helixworks/connector-broker test
pnpm smoke:product | tee /tmp/helixworks-smoke.json
! rg 'aws-sm://' /tmp/helixworks-smoke.json

The claim is falsified if a wrong-tenant request reaches the gateway, output includes the credential reference, or cancellation fails to abort the call. Keep an authorized Northstar call as the positive control.