The execution broker
The newest material in this corpus, and the strongest single idea in it: stop delegating credentials and start delegating operations. It arrived under the name "Service Twin", which is a name this site does not use, for reasons set out on the naming page. Here it is presented by its function.
1. What it is
"the agent presents a cryptographic identity, a signed mandate, the specific action and the contextual evidence that mandate requires, and the broker verifies all of it, performs only the permitted operation using credentials held inside its own boundary, and returns a signed receipt."
The shift, in one line from the source: "the unit of delegation stops being credential access and becomes authorised action."
2. The boundary it closes
This is a gap the corpus had hit three separate times without solving. Short-lived credentials, just-in-time access, workload identity and gateway policy are all real controls, and they share one property:
"all ... eventually hand the agent a credential, and from that moment the agent's effective authority is bounded by the target platform's permission granularity rather than by the business operation."
Which produces a precise statement of what cannot currently be said. A system can say this agent may hold this token for five minutes. It cannot say this agent may perform exactly this operation, on this resource, at this workflow stage, once. The broker can, and the reason is structural rather than clever: the agent does not perform the action at all.
| Control | Bounds | What the agent ends up holding |
|---|---|---|
| Short-lived credentials | How long | A credential |
| Just-in-time access | When | A credential |
| Workload identity | Who | A credential |
| Gateway policy | Which endpoints | A credential |
| An execution broker | The operation itself | A mandate and a receipt |
Every row above is a real control that should still be used. The point is that four of them constrain the same variable in different ways, and the fifth constrains a different variable, which is why it composes with rather than replaces them.
3. Two lines the corpus marked keep-verbatim
"encryption and authorisation must remain separate concepts, since encryption restricts who may read a mandate while the signature and subject binding establish who may exercise it."
"receipts create an evidence chain rather than relying on mutable platform audit logs."
The second connects directly to the discipline of reality. A receipt produced by the party that performed the operation is a fact with provenance. A platform audit log is a report by an interested party about itself, and it is mutable.
4. The two costs, which the site publishes rather than buries
4.1 The concentration risk
"the broker becomes the highest-value target in the estate because it must hold usable credentials, which inverts the catastrophic failure property the rest of the architecture depends on."
This is not a footnote. The entire estate is built on never concentrating credentials: the keys-vault discussion, read-keys-never-write-keys, the LLM bridge. The broker deliberately concentrates them, and it does so because that is the only way to keep them away from the agent. The trade is real, it is architectural, and the corpus states it and does not decide.
Neither does this site. It is question 4, published as the open fork it is. A design that inverts a property four other designs depend on deserves a decision taken deliberately, in the open, by somebody who owns the estate.
4.2 Enforcement is interpretation, not proxying
"enforcing a constraint such as an allowed path list requires understanding the operation rather than proxying it, so the broker is an interpreter per provider per capability rather than a gateway."
Which sets the build cost honestly. To enforce "this mandate permits writing only under this prefix", the broker must understand what a write is in that provider's API, what a prefix means there, and which fields of the request carry it. That is one interpreter per service per operation class. It is not one clever proxy, and anyone estimating this work from the elegance of the concept will estimate it wrong.
5. How it composes with the twin
The broker is where an acting twin gets its hands. The twin carries the persona and the reasoning; the broker carries the credential and the enforcement. A twin-as-actor performs real operations through the broker, and the two records join: an attributable graph transformation on one side, a signed receipt on the other.
They compose precisely because they are different things. Which is the argument for not calling them by the same name. The ruling →