Publish outbound
A connector next to the tool opens outbound relay uplinks. The relay splices the inner mutual-TLS bytes and does not become the service identity.
Agents
Give an agent a narrow capability, not another master key.
Dodona’s implemented local flow combines live service discovery, end-to-end workload identity, peer- and method-limited Biscuit authority, and an auditable MCP call.
One concrete call
An agent reaches an internal tool without making the relay a principal.
Delegate narrowly
The caller receives a Biscuit credential bounded by expiry, expected peer, method tags, channel binding, and optional third-party discharge.
Call through MCP
A local MCP gateway inside the client trust boundary resolves the tool, presents the attenuated credential, and preserves the authenticated workload identities.
01 Name /t/acme/tools/refunds
02 Resolve endpoint + expected identity
03 Prove mTLS binds both workloads
04 Authorize ACL + attenuated authority
05 Record hash-chained audit decision
Authority model
The credential can become less powerful without calling home.
Biscuit is the selected L2 encoding. Rust and Go fixtures exercise offline attenuation, expiry, peer and method restrictions, channel binding, and third-party caveats. A recipient can add restrictions; it cannot remove the issuer’s restrictions.
Third-party policy stays with the resource owner
A discharge can represent a condition such as an open incident or an approval held inside the granting organization. The discharger is another named service, not a special external trust mechanism.
The denial is evidence too
The local MCP gateway test exercised an attenuated delegated tool call and emitted a signed delegation attestation that verifies offline. This is scripted local evidence. It is not a hosted Directory service or a design-partner deployment.
Audit shape
The record carries the authority chain.
Who
Authenticated workload principal and delegated human or agent authority.
What
Resolved object, expected peer, method tags, caveats, and decision.
Verify
Signed attestation output can be checked offline.
Pilot shape
Start with one agent, one internal tool, and one narrow grant.
That is enough to evaluate naming, identity preservation, attenuation, discharge, denial, and audit without changing an entire cluster.