Feature matrix

Everything the platform does, grouped under the four product packages — PaloNexus Core (the authorization decision and authority records), Access Broker (short-lived runtime credentials), Lifecycle (workforce-linked governance and revocation), and Enforcement (the adapters that make the decision stick) — with shipped status and a pointer to where each capability is documented. All rows marked Shipped are built, unit-tested, and verified live on a managed Kubernetes cluster (DigitalOcean Kubernetes — DOKS — example).

PaloNexus Core

The authorization decision itself, plus the authority records it resolves — registry, ownership, delegations, approvals, policy, and the authority trail.

Capability	What it does	Status	Documented in
Agent egress governance	The headline capability: every outbound agent call (model / tool / agent-to-agent (A2A) / external) is decided at one deny-by-default `/authz` — may this agent make this call, on behalf of this human, for this task, right now? — via allowlist → budget → delegation → OPA (Open Policy Agent).	Shipped	Credential-Safe Action Enforcement
Ingress authz	Foundational: every north-south request is decided at the same `/authz` (identity → registry → policy) via Envoy’s external-authorization hook (`ext_authz`); allow stamps `X-Palonexus-Subject`/`-Upstream`. The foundation agent egress builds on.	Shipped	The authorization model, HTTP API
Registry	Source of truth for services/agents/models/tools: upstream, scope, public, kind, allowlists, budget, dataClass.	Shipped	HTTP API
DID/VC identity	Decentralized Identifier (DID) subjects — `did:key` per agent, under a `did:web` issuer anchor; Membership + Capability Verifiable Credentials (VCs) as Ed25519-signed JWT-VCs (VCs serialized as JSON Web Tokens, JWTs).	Shipped	Agent identity & credentials
Cryptographic egress identity	`AGENT_IDENTITY_MODE=vc`: a verified Membership Verifiable Presentation (VP) is required; the spoofable actor header is no longer trusted alone.	Shipped	Agent identity & credentials
VP verification	`POST /v1/agents/verify-presentation` proves holder sig + VC chain + not-revoked, maps `did:key` → agent name.	Shipped	HTTP API
Delegations / TBAC	Task-based access control (TBAC): human-approved, time-boxed Delegation VCs scoped to (actor, task, action, resource); checked on every regulated egress.	Shipped	HTTP API, Consoles
Human-authority delegation	Granting a delegation is an authz decision: requester + approver are active employees in-tenant, and the approver must hold real authority (owner/sponsor/service/team/resource/manager/group/admin or logged break-glass); basis + evidence recorded.	Shipped	Connect agents to enterprise authority, Enterprise IAM API
Agent ownership governance	Mandatory accountable ownership (`owner_ref`/`owner_type`/`team_ref`/`business_sponsor`/`risk_tier`/`approved_runtime`/`status`); owner resolves to an active F2 employee/team; activation gate; no orphaned agents.	Shipped	Connect agents to enterprise authority, Enterprise IAM API
Budgets	Per-agent rolling ceilings: tokens/hour, calls/hour, USD/day; fed by broker usage callbacks.	Shipped	HTTP API, Headers
Human-approved egress hold	needs-approval / external egress is held (default 120s) and resumes on portal approve.	Shipped	Credential-Safe Action Enforcement, Consoles
OPA org policy	Org-wide Rego loaded into OPA as a deny-overrides veto over the inline decision.	Shipped	Architecture
Audit hash-chain	Every decision is a tamper-evident, hash-chained record — the verifiable authority trail; `/v1/audit/verify` recomputes the chain.	Shipped	HTTP API
Compliance credentials	Named-standard attestation (GDPR/HIPAA/SOC2/EU-AI-Act-Art50) issued by a `compliance_auditor`-role human; a real signed `did:web` JWT-VC (not a plain JSON row); feeds the F3 activation gate and F4 revocation cascade.	Shipped	Governance credentials, Enterprise IAM API
Cryptographically verifiable credentials	Generalized signed-VC issuance (`extra_subject`) reused by every governance credential type; issuer key history/rotation; StatusList2021 revocation; a fully offline `{vc_jwt, did_document, status_snapshot}` verification bundle — zero calls to PaloNexus.	Shipped	Governance credentials, Enterprise IAM API
Provenance credentials	Self-declared base-model/training-data/declared-owner attestation issued by a distinct `provenance_attestor` role; a routine model update supersedes the prior credential (no cascade), an explicit revoke does cascade; completes the agent disclosure artifact.	Shipped	Governance credentials, Enterprise IAM API
Observability	`/metrics` (decisions, latency, tokens, cost); OpenTelemetry-protocol (OTLP) traces with DID/VC span attributes → the Grafana LGTM observability stack.	Shipped	Consoles, HTTP API
Human SSO	Dex ships today as the OpenID Connect (OIDC) issuer for gateway/ingress request flows (independent of agent DID/VC; the dev overlay disables it for anon passthrough). Portal/console sign-in is not built yet — the portal is reachable only over the tailnet or `kubectl port-forward`; portal SSO is the planned part.	Planned	Architecture, Env vars
Pluggable persistence	Registry + agent-idp store: `memory` · `postgres` · `mysql` · `sqlite` · `mongodb`; CloudNativePG (CNPG) for Postgres; fail-closed.	Shipped	Agent identity & credentials, Env vars
Operator consoles	Portal: Overview (Authority Command Center), Registry, Decisions, Authority Trail, Identity, Authority Delegation, Credential-Safe Enforcement, Agents, Traces.	Shipped	Consoles
Fleet & ownership summary	agent-idp governance summary (`GET /v1/governance/summary`): the agent fleet joined live to accountable owners and departments via the SCIM directory; posture buckets (`active_healthy` / `owner_inactive` / `blocked`, with `owner_inactive` taking precedence and retired agents excluded); sentinel buckets for unattributed / team-owned / unassigned.	Shipped	Operate the Command Center, Connect agents to enterprise authority
Verifiable authority trail badge	Live hash-chain verification (`GET /v1/audit/verify`) surfaced in the console — green chain-verified / red broken-at-seq / amber verification-unavailable, fail-closed (unreachable never shows verified); delegation-backed decisions carry the delegation id + live expiry countdown on the enforcement feed.	Shipped	Operate the Command Center, HTTP API

PaloNexus Access Broker

Short-lived runtime credentials issued only from valid, human-backed authority — the agent boundary never holds standing secrets.

Capability	What it does	Status	Documented in
STS token exchange	The Security Token Service (STS) exchanges agent proof + delegation evidence into a short-lived audience-bound JWT (`sub`=agent / `act`=human / `cnf` / tight TTL), signed with the issuer Ed25519 key; refused from a revoked/expired delegation; metadata-only audit log.	Shipped	Connect agents to enterprise authority, Enterprise IAM API
Model broker	LiteLLM proxy holding the provider key — the credential is injected outside the agent boundary; logical model names; meters tokens/cost back to the control plane.	Shipped	HTTP API

PaloNexus Lifecycle

Workforce-linked governance: directory sync, stable identity, and the revocation that cascades when the humans behind an agent’s authority change. Runs alongside the workforce identity provider (IdP) — Logto is the supported IAM — shipping in the agent-idp service. See Connect Agents to Enterprise Authority.

Capability	What it does	Status	Documented in
Directory lifecycle sync	SCIM 2.0 (System for Cross-domain Identity Management) User/Group snapshot reconcile per tenant — joiner/mover/leaver/rehire, idempotent, tenant-isolated. Stable subject `<idp>:<tenant>:<external_id>`, never email.	Shipped	Connect agents to enterprise authority, Enterprise IAM API
Stable employee identity	Resolves token claims (Entra ID/Okta) to the stable subject; SCIM authoritative over token claims with explicit precedence; conflicts surfaced, a stale token never reactivates a leaver.	Shipped	Connect agents to enterprise authority, Enterprise IAM API
Revocation cascade	Lifecycle change (owner/sponsor/approver/group/delegation/agent invalid) auto-suspends/quarantines the agent + revokes/invalidates delegations; durable, reason-coded, idempotent; runs at end of every sync.	Shipped	Connect agents to enterprise authority, Enterprise IAM API
Revocation (live)	StatusList-backed; revoking a VC cuts the next `/authz` decision in <1s.	Shipped	Agent identity & credentials

PaloNexus Enforcement

The adapters that make the decision stick at the network layer — the egress-gateway enforcement mode’s Kubernetes implementation, plus the admission-time guarantees.

Capability	What it does	Status	Documented in
Network-layer egress proxy	Forward proxy (`:9092`) confines agent egress; raw `curl` → 407; same decision as `/authz`, audited `egress.proxy`.	Shipped	Credential-Safe Action Enforcement
Envoy egress gateway	Transparent data-plane alternative to the proxy (`SecurityPolicy.extAuth` → `/authz`).	Shipped (`components/egress-gateway`)	Credential-Safe Action Enforcement
Admission webhook	Mutates proxy env into agent pods; rejects un-provisioned agents at registration time.	Shipped (`components/agent-admission`)	Credential-Safe Action Enforcement
Egress identity sidecar	Per-agent sidecar mints a fresh, revocable VP per call so even LangChain’s model client traverses the proxy.	Shipped (`components/egress-sidecar`)	Credential-Safe Action Enforcement

Planned / hardening (not yet shipped)

These are deliberately deferred — the MVP proves the control loop, and these harden it for broad production. They are tracked in the platform BACKLOG.md / README.md checklist, not silently omitted. Partial means a shipped capability has a production-grade upgrade still open; Planned means the capability is scoped but not built.

Capability	What it adds	Status	Tracked in
Signed policy bundles	Serve Rego from a signed OCI bundle so org-policy changes are versioned and audited.	Planned	`README.md` checklist
KMS/HSM issuer key + rotation	Move the `did:web` issuer Ed25519 key into a KMS/HSM and automate rotation. Key history/rotation tracking now ships (`GET /v1/issuer/key-history`, a rotated key’s old credentials still verify) — what’s still open is KMS/HSM-backed storage and automating the rotation itself (today a manual redeploy).	Partial	Governance credentials, `README.md` checklist
SPIFFE/SPIRE workload mTLS	East-west workload attestation over mutual TLS (mTLS), complementary to the portable DID/VC credential.	Planned	`README.md` checklist
Hostname-routed ingress	Route ingress by hostname per service (Envoy does not forward a route-set header to ext_authz).	Partial	`README.md` checklist
Retention-locked audit sink	Ship the hash-chained audit to a retention-locked object store for WORM (write-once, read-many) durability.	Partial	`README.md` checklist
Full SCIM provisioning	Outbound SCIM provisioning beyond the inbound sync reconcile.	Planned	`BACKLOG.md`
ABAC policy engine	Attribute-based policy beyond the inline + Rego model.	Planned	`BACKLOG.md`
DPoP / mTLS-bound tokens	Bind STS tokens to a proof key (today `cnf` proof-of-possession, not channel-bound).	Planned	`BACKLOG.md`
JWKS endpoint + key rotation	Publish issuer keys via a JSON Web Key Set (JWKS) endpoint so resource servers verify STS tokens without out-of-band keys.	Planned	`BACKLOG.md`
Multi-approver workflows	N-of-M / dual-control approval on a single delegation (today single approver).	Planned	`BACKLOG.md`
Token introspection / revocation lists	RFC 7662 introspection and RFC 7009-style revocation lists for STS tokens.	Planned	`BACKLOG.md`

Status legend

Shipped — built, tested, and verified running live on a managed Kubernetes cluster (DOKS example).
Partial — a shipped capability with a production-grade hardening upgrade still open.
Planned — scoped and tracked in BACKLOG.md / the README.md checklist, not yet built.