A permission layer between AI agents and the services they need. Connect any trusted agent identity to any credential system, grant one bounded action, and return the result without handing the agent a reusable secret.
3 writes · BM25 query · replay and path denials
Teams already have identities, policies, passwords, API keys, and cloud accounts. The gateway connects them without becoming another vault or forcing every agent runtime to reinvent secret handling.
Accept agent identity from the system a team already trusts, preserve the accountable human or workload, and namespace every connection to the right tenant.
identity proof → normalized principalCommons Gateway Agents · OIDC · Auth0 · WorkOS · SPIFFE
Bind authority to an exact actor, connection, operation, request, expiry, and run. Consume it atomically once, reject mutation and replay, then write a safe receipt.
authorize → bind → consume once → auditshort-lived · exact-request · fail-closed · attributable
Let a vault, proxy, or cloud identity system apply the credential at the final hop. The agent gets a bounded result, never the underlying password or API key.
execute(opaque binding, request) → responseInfisical · 1Password · Vault · AWS · GCP · Azure
The identity provider says who the agent is and what it may do. The credential provider keeps and applies the secret. The gateway joins those two facts for one exact call.
Authenticates the agent or workload and supplies the accountable principal and allowed action.
Stores the reusable credential and applies it at the final hop without returning it to the agent.
Each Space gets its own policy and audit boundary. A binding maps that logical namespace to the credential provider’s physical group, folder, or path.
Resolves the Space namespace to its provider binding, then turns identity and policy into one exact authenticated action. The agent gets the result—not a reusable key.
Turbopuffer · GitHub · Stripe · Railway · PostHog · any allowlisted service
The recommended product path is a managed call: the authorization issuer and gateway keep the short-lived grant server-side, so even the one-call token is hidden from the agent.
“For run 843, query the team’s Turbopuffer namespace.”
Checks identity, tenant, workflow context, connection rules, approval, and the exact action.
Validates signature, 30-second expiry, method, origin, path, headers, and body hash.
An isolated vault adapter, proxy, or workload identity applies the credential at the final hop.
The allowlisted response returns through the gateway with size and header limits.
Issuer, gateway, credential provider, and destination records can be correlated safely.
No single system has to assert everything. Each records the portion it actually witnessed; shared IDs let administrators reconcile them.
Shared spine Space ID · connection ID · actor ID · operator ID · task/run ID · request fingerprint · provider request ID
Commons should fetch gateway events server-to-server, apply Owner/Host and Space scoping, reconcile Infisical activity, then return safe records to the browser.
Health, call volume by Space, outcomes, latency, replay attempts, and reconciliation gaps.
Join Commons grant, gateway execution, Infisical use, and provider request ID without exposing content.
Denial spikes, 5xx, unusual latency, missing ledger counterpart, policy drift, rate limits, and rotation due.
The gateway assumes callers and inputs can be hostile. Every boundary narrows authority and every useful side effect begins with durable evidence.
A production decision should be based on repeatable evidence: success, denial, failure recovery, and proof that sensitive values never enter the observability plane.
Claim task → request managed call → authorize → consume once → inject → 200 → reconcile three ledgers.
Wrong member, task, method, origin, path, header, body, expiry, replay, redirect, DNS target, or oversized payload must fail closed.
Race two replicas, restart Postgres, kill the gateway mid-call, rotate a key, simulate proxy outage, 429, 5xx, and timeout.
Plant fake secrets in inputs and responses, then prove they never appear in events, metrics, traces, UI, or exported receipts.
A Read + Write key with no Admin/List permission is stored as
TURBOPUFFER_API_KEY in Infisical. The proxy injects it only for
gcp-europe-west1.turbopuffer.com/v2/namespaces/agent-wiki-*.
agent-wiki-canary
409 ticket_replayed
403 path_not_allowed
Live reference implementation Commons Gateway Agents → one-call gateway → Infisical Agent Proxy → Turbopuffer is proven. The provider-neutral contracts shown above are the next architecture slice before adding a second identity and credential provider.
Select a role to see the practical product flow. The interfaces differ, but each produces the same accountable request receipt.
Pick the Space, provider, environment, and narrow actions the connection should support.
Prefer a Railway project token, restricted Stripe key, or scoped PostHog key—not an owner credential.
Place the real value in the environment and folder for this connection. Commons stores only the reference.
Bind a service template to the allowlisted host and specify exactly where Infisical may inject the credential.
Choose allowed agents, task requirement, approval threshold, methods, paths, TTL, and rate limits.
Execute a harmless read, confirm all three records agree, then publish the connection to the Space.
The authorization issuer owns authority. The credential provider owns secrets. The gateway owns one-use enforcement and execution evidence. Agents own neither the reusable credential nor the policy.
Provisioning systems can spin up projects and integrations. They should hand back scoped connection references—not permanent provider secrets—to Commons.
Create the project, restricted service account, webhook, or API key.
Receive, rotate, and apply the credential under a per-environment service binding.
Authorize one exact agent action and produce a durable, sanitized receipt.
The canary proves the core chain. The next milestone is turning configuration and raw audit plumbing into a role-scoped Commons product experience.
Agent Wiki on Turbopuffer is the first write-capable canary. Keep indexing to public wiki content first; add private content and Stripe only behind typed actions, stronger approval, and provider-side controls.