Access model
Who may connect, what an agent is allowed to do, and who keeps the final say. Legate grants delegated access: who the agent represents, what packs it holds, and that humans conclude writes. The AI never keeps lasting power to commit changes. Legate is not the shared record itself.
Forward with Disclosure Boundary when security or legal reviews the pattern. Workflow roles: Actor boundaries. Token detail for implementers: Authentication.
Who acts
| Actor | What they do |
|---|---|
| Operator | Entitles Legate on a Stratum peer. Opens install and credential minting. Never exports signing material for convenience |
| Agent / integrator | Calls tools under a short-lived credential. Holds packs, not lasting commit authority |
| External signer | Human or dedicated signer that applies the final signature after prepare |
| Legate | Verifies credentials, exposes packs, returns prepare/submit interfaces |
| Agent host | Private generative runtime. Out of this contract. Must not keep lasting power to commit |
What agents may do
Access is expressed as capability packs on the connection credential. In plain language: what the agent is allowed to do.
| Pack | Boundary |
|---|---|
legate.read | Observe / query scoped shared state |
legate.write | Client write sequence only: simulate → prepare → submit_signed |
| Ops (by arrangement) | Day-2 capabilities, not a public admin console dump |
A call outside the granted pack is denied. Read credentials cannot escalate to writes by naming a write tool.
Write authority
| Step | Who acts | What it means for control |
|---|---|---|
| simulate | Agent (write pack + consent) | Dry-run / preview. No commit |
| prepare | Agent | Proposal and review payload. Does not commit |
| sign | External signer | Final signature. Humans (or a dedicated signer) keep the final say |
| submit_signed | Agent | Submits the already-signed payload |
Production deployments do not leave lasting commit power in the agent host or the MCP process. That is the control story buyers should require of any agent path to the shared record.
What this page does not publish
- Policy source files or allow/deny rule content
- Scoring / guard engine internals
- Mandate business rules beyond the four-step client sequence
Those stay in private engineering materials. See Disclosure Boundary.