[cooktheryan]

Summary

• Propose an optional, fixed Agent Author Role for a human OCC Principal in one Namespace.
• Let the assigned person create and manage Agents through the existing OCC Console without Installation administration. No user receives the Role by default.
• Define the required Agent, Configuration, Secret, credential-source, and supporting-resource permissions, plus credential-grant, audit, restriction, and revocation boundaries.
• Extend the IAM Driver contract for immutable human principalId lookup and transactional managed Namespace bindings; unsupported selected Drivers fail closed without fallback.
• Require reauthorization after the Namespace lock, retain grants needed by unfinished deployments, and preserve independently managed credential bindings during reconciliation.
• Keep the grant Namespace-wide: it covers all matching existing and future resources in that Namespace, including every Secret. The Role does not provide per-user resource ownership.

The assignment authorizes credential consumption through user-controlled Agents. Hidden Secret metadata values do not prevent those workloads from using or exposing supplied credentials. Use separate Namespaces for users who must not share that authority; runtime isolation and network enforcement remain operator responsibilities.

ServiceAccount credential issuance is excluded. Initial Agent runtime credential provisioning remains permitted through Agent read/operate and the existing lifecycle checks. These clarifications do not change the proposed permissions.

Research

Current Namespace policy cannot grant agent:create, while the Agent workflow needs collection-level authority and permissions on supporting resources. Kubernetes RoleBindings do not authorize OCC API requests, and OCE Agents are not Kubernetes custom resources. The proposal therefore uses OCC authorization and grants no Kubernetes API access.

The optional Role supports self-service through the existing Console and keeps Installation administration with operators. Operators must assign it only where shared access to all matching Namespace resources is intended. AWS is only a validation environment; the proposal adds no AWS-specific product behavior.

Files

• specs/README.md
• specs/rfcs/0025-agent-author-role.md
• specs/plans/0025-agent-author-role.md

Feasibility evidence

• At implementation commit cd6683bb3, all six recorded Kubernetes QA stages passed, including model execution, credential replacement, activation cleanup, and the assigned-human lifecycle. The human performed Stop, was denied Stop/Delete after revocation, and performed Delete after explicit reassignment. Database return values confirmed the Restriction fixture was inserted and removed. These results supersede earlier artifacts for persisted Restrictions and assigned-user Stop/Delete.
• The PostgreSQL namespace IAM suite passed 19/19 without skips. The pending-deployment regression failed before the repair, then verified grant retention for queued and claimed work and cleanup during reconciliation after completion while preserving an administrator-created binding. IAM, Console API, and QA-fixture checks passed 137/137 without skips.
• Reviewer-accessible evidence: updated assertions, QA stages, and regression record. PR #4059 embeds the refreshed Console screenshots and walkthrough. Reports omit identity/resource IDs; media excludes credential values, IPs, and private endpoints.
• Full Compose qualification remains blocked during startup by EACCES on chown /routing/gateway-api-key. An initial concurrent Kubernetes run failed at browser login with ERR_NETWORK_CHANGED; its sequential retry passed. Redacted attempt outcomes preserve these limits. The test clusters/databases were removed and the validation host was stopped.
• Feature follow-up d19e91ad6 merges main and repairs integration and generated API documentation. Module-policy checks passed 2/2, Create Agent browser checks 18/18, and lint, typecheck, formatting, OpenAPI and workspace checks passed. Runtime qualification remains tied to cd6683bb3; current-head CI is not established by earlier results.

Documentation checks

Index correction 4b6e76f80 makes the summary match all 25 RFC rows: 9 implemented, 8 partially implemented, and 8 not implemented.

Formatting and whitespace checks passed. Local length, documentation, and spec checks remain blocked by missing @sindresorhus/slugify; no dependencies were installed. Dependency-independent estimates put the RFC near 1,200 words and its plan near 2,000, below the 2,500-word limit. The plan stays together as one delivery record with historical and superseding qualification. Manual Notes and historical results are preserved.

The RFC remains Proposed, with implementation unmerged. Maintainer acceptance of the IAM contract and shared Namespace/Secret authority remains open.

Review focus

• Is Namespace-wide authority over all matching existing and future resources, including every Secret, acceptable for this optional Role?
• Is the IAM Driver extension for human principalId lookup and transactional Namespace bindings acceptable, with unsupported Drivers failing closed?
• Should assignment remain limited to human Principals?
• Should the first release support the existing editable Configuration workflow, with any Preset-only restrictions deferred until they can be enforced by the server?

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge.

What this changes

This PR proposes an optional human-only Agent Author Role, its Namespace-wide permissions, and an implementation plan.

Example: An administrator delegates Agent management in the default Namespace.

• Before: Exact-resource IAM policy cannot delegate agent:create through the supported policy API.
• After: Under the proposal, an explicitly assigned human can create Agents and manage matching Namespace resources, including every Secret.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The documents are coherent and the earlier finding is resolved; readiness remains capped by the unresolved owner decision.
Proof confidence	🌊 off-meta tidepool	Not applicable: This specification-only patch changes no executable behavior; the companion implementation's reported runtime qualification remains separate from RFC acceptance.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Feature · Worth it: Needs a maintainer decision · Fix scope: Complete
User problem: Administrators must prepare Agents because ordinary users cannot receive collection-level creation authority through the supported Namespace policy API.
Reason: Self-service has clear value, but trusting assignees with all matching Namespace resources and credentials is an unresolved product and security decision.

Merge readiness

⛔ Blocked before merge - 2 items remain

Keep open for maintainer review: the proposal addresses a real delegation gap, and no actionable document defects remain.

Priority: P3
Reviewed head: 4b6e76f803832967bc798d0bbd597bb5c13010f5
Owner decision: Required. See Decision needed.

Decision needed

• Question: Should OCC support this human-only managed Role with editable Configurations, access to every matching Namespace resource and Secret, and the proposed transactional IAM Driver extension?
• Recommendation: Accept for intentionally shared Namespaces: Approve the documented trusted-credential-consumer boundary, retaining explicit assignment, Restriction precedence, transactional authorization, and the stated revocation limits.
• Why: These are deliberate expansions of the supported delegation contract, and no responsible reviewer has recorded acceptance.

Before merge

• Await maintainer action - The responsible human reviewer must resolve the RFC's proposed IAM contract and shared Namespace authority.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Findings

None.

Agent review details

How this fits together

OCC authenticates callers and uses the selected IAM Driver to authorize resource operations; the proposal extends managed bindings and transactional credential grants within that existing path.

flowchart TB
Admin[Installation administrator] -. Proposed assignment .-> IAM[Selected IAM Driver]
Human[Human Principal] --> Console[OCC Console and API]
Console --> IAM
IAM -. Proposed authorization .-> Resources[Namespace Agents and resources]
Resources -. Exact credential grants .-> Agent[Agent ServicePrincipal]

Loading

Technical review

Best possible solution:

Resolve the explicit authority and IAM contract decision before landing this RFC ahead of its linked implementation.

Do we have a high-confidence way to reproduce the issue?

This is a feature proposal; current source and existing integration assertions confirm the supported policy API cannot delegate create permissions.

Is this the best way to solve the issue?

The proposal reuses OCC, the selected IAM Driver, and existing transaction owners, while clearly exposing the broad credential authority that requires an owner decision.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 5a61a08eec78.

Provenance checked

• RFC inventory keeps the original intent (d73a78e: The preceding RFC added the Sandbox Harness mode-support proposal to the existing inventory.)

Security

None.

Evidence

What I checked:

• Explicit decision boundary: The RFC remains Proposed and requests acceptance of the human-only Role, shared Namespace authority, and IAM Driver extension. (specs/rfcs/0025-agent-author-role.md:63, 4b6e76f80383)
• Current-main capability boundary: Current authorization documentation and OCC validation reject create permissions through exact-resource Namespace policy; the requested managed delegation is therefore a new capability. (docs/reference/authorization.md:218, 5a61a08eec78)
• Existing behavior has an intentional reason: fix(iam): refuse create permissions at namespace role creation #1602 explains that create permissions were refused because the supported API could not bind them effectively; this RFC explicitly proposes a narrow managed exception. (packages/occ/src/index.ts:1865, 5a352ed4c0f3)
• Separate implementation remains open: feat(iam): add optional Agent Author role #4059 is the same author's draft implementation and explicitly awaits the RFC's decisions; it does not establish acceptance or availability on main.
• Earlier finding resolved: The reviewed head corrects the RFC inventory to 9 implemented, 8 partially implemented, and 8 not implemented, matching its 25 rows. (specs/README.md:39, 4b6e76f80383)
• Current-head checks: The exact reviewed head has successful CI Required and Suite Audit and Static Checks results; the previously pending admission check has completed successfully. (4b6e76f80383)

Labels

Label changes:

No label changes.

Label justifications:

• P3: This is an optional architectural proposal with no runtime change or current regression.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: ⏳ waiting on maintainer: Only explicit maintainer approvals or decisions remain; merge is still blocked.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (9 earlier review cycles; latest 8 shown)

• reviewed 2026-10-29T15:14:38.528Z sha 2a4d736 :: blocked before merge. :: [P2] Use the next contiguous RFC number
• reviewed 2026-10-29T15:24:16.430Z sha d627d1b :: blocked before merge. :: none
• reviewed 2026-10-29T16:06:06.707Z sha c7d248d :: blocked before merge. :: none
• reviewed 2026-10-29T16:55:13.262Z sha d826622 :: blocked before merge. :: none
• reviewed 2026-10-29T17:08:20.070Z sha 94208b6 :: blocked before merge. :: none
• reviewed 2026-10-29T21:31:13.631Z sha 2388891 :: blocked before merge. :: [P3] Update the RFC status total when adding this proposal
• reviewed 2026-10-29T21:54:27.541Z sha 2388891 :: blocked before merge. :: [P3] Update the RFC status total when adding this proposal
• reviewed 2026-10-29T22:45:00.903Z sha 4b6e76f :: blocked before merge. :: none

Reviewed October 29, 2026, 7:00 PM ET / 23:00 UTC (Revision 10).

[cooktheryan]

@clawsweeper re-review the current RFC revision, including the proposal scope, permission boundaries, and RFC numbering.

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/40899877047
• Updated: 2026-10-29T15:16:44.509Z

[cooktheryan]

@clawsweeper re-review current RFC-0024 revision; check the required file set, numbering sequence, and proposal requirements.

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/40901445187
• Updated: 2026-10-29T15:25:57.061Z

[cooktheryan]

@clawsweeper re-review RFC head 5aaae14b6343660602ef9bbaa72ebc14c7b02a03.

The RFC now explicitly retains credential grants needed by queued and claimed deployments and requires assigned-human Stop/Delete proof, rejection after revocation, restored authority after reassignment, and evidence that Restrictions actually applied. The plan adds superseding qualification for runtime commit cd6683b and distinguishes it from merge follow-up d19e91a. Earlier evidence and Manual Notes are preserved; the corrected reports supersede the earlier Restriction and assigned-user lifecycle claims.

The opening description links the updated assertions, stage output, regression record, media in #4059, and explicit failed-attempt limits. Full Compose qualification remains blocked at startup. Current-head CI and maintainer acceptance remain open. The RFC stays Proposed, with implementation unmerged.

Formatting, whitespace and relative-file link checks passed, and all ten evidence links checked returned HTTP 200. Independent GPT-6.1 Sol document review found no actionable defects. Full docs/length/spec checks remain blocked by missing local documentation dependencies; no dependencies were installed or product tests run for this prose-only change. Dependency-independent estimates are about 1,200 words for the RFC and 2,000 for the coherent delivery plan, below the 2,500-word limit.

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/40958670157
• Updated: 2026-10-29T21:32:53.813Z

[cooktheryan]

@clawsweeper re-review current head 23888911f0ab19bca4487b42ea0d8da99e358d82.

• CI run 40957881038 passed on this head. Please reconsider any CI-related review holds.

This automated follow-up reports observed GitHub workflow state; it does not claim a failure was repaired or that maintainer approval was granted. Please re-evaluate the current revision and evidence.

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/40961842478
• Updated: 2026-10-29T21:56:08.990Z

[cooktheryan]

@clawsweeper re-review RFC head 4b6e76f80.

The remaining author finding is fixed: specs/README.md now reports 9 implemented, 8 partially implemented, and 8 not implemented RFCs, matching its 25 rows. I checked the row inventory directly; formatting and whitespace checks pass. This is a documentation-only correction, with no product tests or permission changes. The RFC decision remains Proposed and needs maintainer acceptance.

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/40968353118
• Updated: 2026-10-29T22:46:33.926Z

[cooktheryan]

@clawsweeper re-review current head 4b6e76f803832967bc798d0bbd597bb5c13010f5.

• The PR head changed from 23888911f0ab19bca4487b42ea0d8da99e358d82 to 4b6e76f803832967bc798d0bbd597bb5c13010f5. Review the latest patch after its workflow state is available.
• CI run 40967637701 passed on this head. Please reconsider any CI-related review holds.

This automated follow-up reports observed GitHub workflow state; it does not claim a failure was repaired or that maintainer approval was granted. Please re-evaluate the current revision and evidence.

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/40970278496
• Updated: 2026-10-29T23:02:29.705Z