Skip to content

Document KYA use case for agent client authorization on envoy AI GW #193

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mkedjour merged 3 commits into from
Apr 10, 2026
+91 −0
Merged

Document KYA use case for agent client authorization on envoy AI GW #193

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c724f9e
Document KYA use case for agent client authorization on AI GW
mksinghtx Apr 9, 2026
b69b74f
Updated description for use case using KYA or VC
mksinghtx Apr 9, 2026
0bb7067
Merge pull request #1 from mksinghtx/mksinghtx-patch-1
mksinghtx Apr 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
91 changes: 91 additions & 0 deletions docs/contribute/wip/7_Brokered_identity_Gateways/kya_use_case_platform
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,91 @@
—---With KYA or VC —----
Agent Client with KYA Registration and Policy-Based Authorization

```
\+-------------------------------------------+
| START: Agent (Github action, claude, cursor|
\+-------------------------------------------+
|
v
\+--------------------------+
| AI Gateway (Envoy) |
| (mcp.prod.env.corp.net)
\+--------------------------+
|
v
\+--------------------------+
| KYA Registration/Attestation|
| 1. Agent registers with attributes/proves identity (KYA credential/VC)
\+--------------------------+
| Token Request (KYA Proof, Location, Time Context)
v
\+--------------------------+
| Authorization Service |
| (Policy Evaluation) |
| 1. Validate KYA Attestation
| 2. Evaluate Policy (based on Location, Time, etc.)
| 3. Issue Initial Token (e.g., JWT with claims)
\+--------------------------+
| Initial Token Issued
|
\+--------------------------+
| Agent Client (Send Request)|
\+--------------------------+
| Request sent with Initial Token (e.g., JWT)
v
\+--------------------------+
| AI Gateway (Envoy) |
| (mcp.staging/prod.env.corp.net)
\+--------------------------+
| MCPRoute intercepts request
v
\+--------------------------+
| Initial Token Validation |
| 1. Extract Initial Token
| 2. Validate Token (domain, org, signature, claims, expiration)
\+--------------------------+
|
+--\[Validation Fails\]---\> Request Rejected (END)
|
+--\[Validation Success\]--\> Token Exchange Request
v
\+--------------------------+
| Token Exchange Service |
| 1. Exchanges Initial Token for |
| API/Domain specific Token |
| after Caller/Callee badge/cert verification |
\+--------------------------+
| New Token attached to request
v
\+--------------------------+
| Routing |
\+--------------------------+
/ \
/ \
v v
\+-----------------+ +----------------------+
| Flux MCP Server | | Victoria Metrics MCP |
| (:9090/mcp) | | (:8080/mcp) |
\+-----------------+ \+----------------------+
| Remote or local origin access |
v v
\+-------------------------------------------+
| connects to API/tool( eg read-only mode) using|
| API/domain specific Token |
\+--------------------------------------------+
|
v
+-------+
| END |
+-------+
+------------------------------+
| Connects to \`vmselect\` service |
| in telemetry-system namespace |
| using API/domain specific Token |
+------------------------------+
|
v
+-------+
| END |
+-------+
```
Loading