# 03 — The Service Twin, and the naming collision

The newest twin material (19 August, 8,488 words across the brief and its market research) — and the corpus's own review flags the problem this document resolves: ***"the name collides, because twin already means something specific in this corpus."***

---

## 1. What the Service Twin is

An execution broker:

> *"the agent presents a cryptographic identity, a signed mandate, the specific action and the contextual evidence that mandate requires, and the broker verifies all of it, **performs only the permitted operation using credentials held inside its own boundary**, and returns a signed receipt."*

The shift it makes: *"the unit of delegation stops being credential access and **becomes authorised action**."* And the gap it closes is one the corpus had hit three times without solving — short-lived credentials, JIT access, workload identity and gateway policy *"all… eventually hand the agent a credential, and from that moment the agent's effective authority is bounded by the target platform's permission granularity rather than by the business operation."* A system can say *this agent may hold this token for five minutes*; it cannot say *this agent may perform exactly this operation, on this resource, at this workflow stage, once.* The broker can, **because the agent does not perform the action at all.**

Two lines the corpus marked keep-verbatim:

> *"encryption and authorisation must remain separate concepts, since encryption restricts who may read a mandate while the signature and subject binding establish who may exercise it."*

> *"receipts create an evidence chain rather than relying on mutable platform audit logs."*

## 2. The two costs the corpus adds

The conversion review added what the original did not foreground, and both belong on the page:

1. **The concentration risk.** *"the broker becomes **the highest-value target in the estate** because it must hold usable credentials, which **inverts the catastrophic failure property** the rest of the architecture depends on."* The whole estate is built on never concentrating credentials — the keys vault discussion, read-keys-never-write-keys, the LLM bridge. The broker deliberately concentrates them. That is a real architectural trade, not a detail.
2. **Enforcement is interpretation, not proxying.** *"enforcing a constraint such as an allowed path list requires **understanding the operation** rather than proxying it, so the broker is **an interpreter per provider per capability** rather than a gateway."* Which sets the build cost honestly: one interpreter per service per operation class, not one clever proxy.

## 3. Why the name collides

| | Corpus twin | "Service Twin" |
|---|---|---|
| **Is** | the graph's endpoint into reality — an interface the model arrives at | a credential-holding **execution broker** |
| **Holds credentials** | no | **yes — that is its whole function** |
| **Direction** | the model reaches *out* through it | the agent's requests pass *through* it |
| **Failure property** | an unconnected twin is a tracked air gap | a compromised broker is estate-wide |

They rhyme — both stand between the model and a real system, and the S3 container blurs the line by being both an interface twin *and* a thing that holds backend access. But the security properties are opposite, and a site that uses one word for both will mislead precisely the readers who matter.

## 4. The resolution to publish

1. **"Twin" keeps its corpus meaning** — the graph primitive of `01__`. It is older, it is load-bearing in the ladder and the edge grammar, and five sites already depend on it.
2. **The broker is presented by its function: the execution broker** (or *action broker*). The page notes it arrived under the name "Service Twin" and why that name was set aside.
3. **The relationship is stated, not hidden:** the broker is where an *acting* twin (`01__` §6) gets its hands — a twin-as-actor performs operations *through* the broker, so the two designs compose: the twin carries the persona and the reasoning; the broker carries the credential and the enforcement.
4. **Publish the collision itself** on `/naming/`. The corpus caught its own drift within one document — *"a naming collision is flagged"* — and that is the reality-document discipline visibly working. It is also the same lesson `skills.sgit.ai` teaches with its diverging duplicate: names and copies drift unless something checks them.

---

This document is released under the Creative Commons Attribution 4.0 International licence (CC BY 4.0).