Agent Enrolment Without Borrowed Authority: The Append Lane Is The Narrow Door
Summary
An enrolment architecture that lets an agent obtain a project-recognised identity starting from nothing but a keypair — no repository credential, no project token, no certificate authority key, no vault key, no administrator identity — because every one of those grants authority broader than the identity being created. The agent signs a canonical request over its own public key, delivers it through an append lane whose granted capability is to add an object to an inbox and nothing else, and a trusted processor holding the issuing key reads the inbox, applies policy and publishes the result. Identity and mandate stay separate signed statements throughout.
Key concepts
- The initial state is the design — computation, randomness, its own private key, and nothing else
- The enrolment request — the canonical fields, and what proof of possession does and does not establish
- The narrow door — append-only ingress: add to an inbox, never read it
- The trusted side — the untrusted side never holds more than its own key
Key ideas
- Possession of this private key lets the agent act as itself, rather than as the project or the human operator.
- The nonce is not optional, and the canonical form must be specified precisely or the signature covers whatever the verifier reconstructs.
- A hostile agent can add junk to an enrolment inbox and can reach nothing else — the blast radius of the ingress is a queue that needs draining.
- Registries recognising registries works, and requires each to declare which roots it accepts.
On this site
Became the enrolment page. Its milestones were revised down by the append-lane correction published two days later.