Problem
JWT authentication currently accepts only owner-session tokens. Giving an external agent runtime an owner token grants broader conversation capabilities than it needs and cannot bind access to a specific agent turn.
Proposed change
Implement a delegated_agent token profile with short lifetimes and resource-bound claims. Define and validate claims for:
- tenant and principal owner
- client/service identity
- agent reference
- optional conversation ID
- optional turn ID
- token kind, audience, issuer, JTI, and validity window
- a narrow delegated permission set
Add permissions appropriate to the agent integration, such as:
agent_turn:startagent_turn:replayagent_turn:finalizeagent_response:read
Do not map delegated tokens to broad owner operations such as conversation deletion, truncation, regeneration, or unrestricted transcript append/read.
For first-turn creation, define a launch-token flow that permits exactly one idempotent atomic start and can yield or authorize the resulting turn-bound operations. Threadmark should validate tokens but should not become the general identity issuer.
Acceptance criteria
- Owner-session behavior remains unchanged.
- Delegated tokens are accepted only with valid resource claims and narrow permissions.
- Agent, conversation, and turn claim mismatches are rejected without leaking resource existence.
- Delegated tokens cannot invoke owner-only endpoints.
- Token lifetime, replay/JTI policy, launch-token semantics, and issuer responsibilities are documented.
- Unit and API tests cover valid tokens, each claim mismatch, expired/future tokens, permission failures, and owner-resource isolation.
Integration context
This is the recommended production identity boundary for Bonsai-to-Threadmark requests. Trusted headers or owner tokens should remain development-only alternatives.
Problem
JWT authentication currently accepts only owner-session tokens. Giving an external agent runtime an owner token grants broader conversation capabilities than it needs and cannot bind access to a specific agent turn.
Proposed change
Implement a
delegated_agenttoken profile with short lifetimes and resource-bound claims. Define and validate claims for:Add permissions appropriate to the agent integration, such as:
agent_turn:startagent_turn:replayagent_turn:finalizeagent_response:readDo not map delegated tokens to broad owner operations such as conversation deletion, truncation, regeneration, or unrestricted transcript append/read.
For first-turn creation, define a launch-token flow that permits exactly one idempotent atomic start and can yield or authorize the resulting turn-bound operations. Threadmark should validate tokens but should not become the general identity issuer.
Acceptance criteria
Integration context
This is the recommended production identity boundary for Bonsai-to-Threadmark requests. Trusted headers or owner tokens should remain development-only alternatives.