Skip to main content

Deploy a boundary adapter PEP

Design-stage

Boundary enforcement is designed (docs/phases/phase-5-gateway-boundary-stepup-coldstart.md, FR-14) but not yet implemented. This page describes the three modes as designed, in decreasing order of strength, so you can pick the right one to plan for once they ship.

Goal (designed): enforce policy at a boundary you control, for an agent you do not control or cannot modify — a third-party agent, a managed connector, or a runtime you don't operate. See Enforcement point tradeoffs for when a boundary adapter is the right choice over a sidecar or gateway.

Pick a mode, strongest first​

1. Resource-server mode (strongest)​

A library + middleware (FastAPI first) at your own API/tool boundary that requires SDK-issued, per-call scoped tokens (Rich Authorization Requests, RFC 9396) plus a transaction token for any privileged call — see The taint and provenance model for transaction tokens. Use this when you own the resource the agent is calling, even if you don't own the agent itself.

2. Connector / MCP-proxy mode​

An SDK-managed MCP-native proxy that you repoint the agent's connector configuration at. It performs the policy check and token exchange transparently, so the agent's own configuration changes but its code doesn't. Use this when the agent speaks MCP and you can change its connector target but not its internals.

3. Egress-proxy / mesh-sidecar mode​

An injected, TLS-inspecting egress proxy so the agent's only route out is through the SDK. This requires installing a trust certificate in the agent's runtime — the strongest option when you control the network path even if you control nothing else about the agent.

4. Reduced-guarantee mode (weakest — use only when nothing above is possible)​

Coarse outer scoping at grant time, plus revocation and edge audit only — no per-call narrowing. This mode is required to surface itself explicitly: every response and log line carries a guarantee_level field, so a reduced-guarantee deployment can never be mistaken for full enforcement. If you deploy this mode, say so in your own integration's documentation too.