Split out of #457, which closes with the AARM v1.0 gap assessment recorded.
The gap
R9 asks for least-privilege enforced through short-lived, minimal-scope credentials. cMCP satisfies the spirit of it with deny-based Cedar policy: a call that is not permitted is refused at the gateway.
Those are not the same control, and the difference is what happens when the gateway is bypassed. A denied Cedar decision constrains what the agent can do through cMCP. A short-lived minimal-scope credential constrains what the agent can do at all, because the credential it holds does not authorise more and expires on its own. The first is a policy decision at a chokepoint; the second is an authority the agent never had.
Recorded in #457 as "still partial" and deliberately not claimed.
What would close it
Not proposing an implementation. The shape of the question is whether cMCP issues or brokers downstream credentials at all, which is a product boundary rather than a coding task:
- does the gateway mint scoped, short-lived credentials for upstream MCP servers, making it a credential broker
- or does it stay a policy chokepoint and R9 is documented as a deviation permanently
Both are defensible. The first is a materially larger surface, including key custody for the minting key, which touches the TEE work.
Not in scope
R3 and R7, which are also unclaimed but for a different reason: they need semantic comparison, and a structural proxy is not a semantic measure. See #457.
Split out of #457, which closes with the AARM v1.0 gap assessment recorded.
The gap
R9 asks for least-privilege enforced through short-lived, minimal-scope credentials. cMCP satisfies the spirit of it with deny-based Cedar policy: a call that is not permitted is refused at the gateway.
Those are not the same control, and the difference is what happens when the gateway is bypassed. A denied Cedar decision constrains what the agent can do through cMCP. A short-lived minimal-scope credential constrains what the agent can do at all, because the credential it holds does not authorise more and expires on its own. The first is a policy decision at a chokepoint; the second is an authority the agent never had.
Recorded in #457 as "still partial" and deliberately not claimed.
What would close it
Not proposing an implementation. The shape of the question is whether cMCP issues or brokers downstream credentials at all, which is a product boundary rather than a coding task:
Both are defensible. The first is a materially larger surface, including key custody for the minting key, which touches the TEE work.
Not in scope
R3 and R7, which are also unclaimed but for a different reason: they need semantic comparison, and a structural proxy is not a semantic measure. See #457.