Identity from the caller, credentials on the server

The confused-deputy problem is the standing failure of agent systems: an agent acting for one principal is talked into acting for another, or holds a credential that leaks into a transcript. I remove it by construction. Identity is derived from how a caller authenticated, never from an argument in a tool call. Credentials for external services live on the server side of a gateway, are minted per identity where the platform allows it, and are never handed to a model.

The shape

A gateway between agents and the outside world authenticates the agent, derives its assignment or employee identity from that authentication, and performs the external call itself with credentials it holds. Attribution is written into the external payload only where that exact operation has been shown to round-trip it. Tokens for a platform identity are minted on the server from certificate assertions and checked in-process before use. An agent that needs to touch a repository, a payment or a social post asks a gatekeeper that holds the credential.

Where it appears

In FAFOHive, three binding tools derive an agent's assignment on the server so it cannot bind a website or mailbox for a business that is not its own: Agents with real tools and no keys.

In Helix, every meeting action names the digital employee it acts for: Solving the digital-employee identity.

In Agent Swarm, a coding agent on a local model edits, tests and pushes: A coding agent that never holds the keys.

In the Auth and access plane, the consent screen is the real control: The hardening fix that locked everyone out.

The agent sideThe server side

FAFOHivean authenticated sessionHelixthe name of the employee it acts forAgent Swarma worker that edits, tests and pushesAuth and access planean assistant that registered itself

credentials for several hundred vendor operations; the assignment, derived from its sign-intokens minted per employeethe repository credential, with a gatekeeperthe grant, approved by a person on the consent screen

What it buys and what it costs

It buys attribution you can trust, because the identity on an action was established by authentication. It buys a blast radius bounded by what the server will do for that identity. It buys the ability to let agents touch real systems at all.

It costs a gateway that must itself be correct, and it costs a human at the grant step. I keep that gate narrow and keep it.

The judgment in it

The first version

Shared key files on every agent seat.

Now

Empty-handed seats; the keys sit behind the gateway.

The first version worked, and it was wrong, and I removed it. The lesson generalises.

Anything that works by trusting what an agent says about itself is a design that has not failed yet.