Authority

Capability brokering

Also called: credential brokering · capability mediation

DefinitionCapability brokering is the practice of having a trusted intermediary perform an authorized operation using a credential it retains, returning only the result to the requester.

The usual way to let an agent use an external service is to give it a token. The agent holds the credential and makes the call.

Capability brokering inverts the custody. The credential stays with a trusted broker. The agent asks for an operation, the broker validates that the operation is allowed, performs it using the credential, and returns the result. The agent receives an answer; it never receives the key.

Why custody is the whole game

A credential is not a permission — it is every permission that credential carries, for as long as it remains valid. Give an agent a GitHub token so it can read one repository, and it now holds whatever else that token can do, indefinitely.

Worse, the handover is irreversible. Once a secret has been read it exists in a context window, possibly a log, possibly a provider’s retention window. You cannot un-read it. The only remedy is rotation, and rotation only happens if someone notices, which nothing in the normal workflow encourages.

Brokering removes the whole category. There is no secret in the agent to leak, so there is nothing to rotate after the fact.

Ordering is the security property

A broker’s steps have to run in a specific order, and the order matters more than any individual check:

  1. Resolve who is calling, from process identity rather than a claim
  2. Resolve their containment session
  3. Load the exact registered tool — not one the server advertised
  4. Normalise the parameters
  5. Evaluate policy
  6. Evaluate grants, where the denial is overridable
  7. Only now, retrieve the credential and perform the operation

Step 7 last is the point. If the credential is fetched earlier, there is a window in which a secret has been retrieved for a call that turns out not to be permitted — and that window is where the interesting bugs live.

What a broker must never expose

A broker is only as good as the operations it refuses to offer. Every one of the following is a single call that collapses the entire model, and a broker that ships any of them has built an elaborate way of handing over the token:

  • a generic HTTP proxy
  • a generic credential proxy
  • an arbitrary shell command endpoint
  • a raw token retrieval API
  • any “reveal secret” operation

BitShout’s capability broker has none of them. See the broker architecture for the full model, and MCP security for how it applies to Model Context Protocol tools.