37 lines
2.4 KiB
Markdown
37 lines
2.4 KiB
Markdown
# First-class agents and forensic observability
|
|
|
|
User clarification, 2026-10-13: agents must operate the application as first-class
|
|
clients, including tabs, permitted settings and bookmarks. Central administrators
|
|
can disable access and limit individual capabilities. Mandatory corporate policy
|
|
applies equally to a human and an agent. Generic JavaScript/CDP, cookie extraction
|
|
and overriding a centrally locked setting are not alternate control paths.
|
|
|
|
Agent authentication must support cryptographic client identity, narrowly scoped
|
|
revocable credentials, bounded requests, replay protection and attributable audit.
|
|
Current loopback capability tokens and Windows DPAPI are a foundation; delegated
|
|
per-agent identities, request proof of possession and individual revocation remain
|
|
required work. Full UI automation, history/library, safe screenshots and broader
|
|
application capabilities remain separately tracked from the implemented controls.
|
|
|
|
Security analysts need enough detail to reconstruct what happened: navigation,
|
|
download name/source/hash/scan outcome, click target, copy/cut/paste direction,
|
|
initiating tab/agent and the relevant rule and result. Confidentiality alone must
|
|
not suppress security-relevant evidence. Passwords and authentication tokens must
|
|
never enter logs. URLs, element labels and content may themselves contain secrets;
|
|
they need typed redaction and centrally governed evidence collection.
|
|
|
|
The security audit and confidential evidence store are distinct from operational
|
|
OpenTelemetry. The evidence store must encrypt records, bind them to immutable
|
|
event identities, restrict analyst access, log every access, enforce retention and
|
|
support incident correlation and SIEM references. Selected relevant content may be
|
|
retained by policy; storing entire documents is not required. Existing metadata
|
|
events do not satisfy this full forensic requirement. Detailed download records,
|
|
human click tracking and controlled content evidence are still to implement.
|
|
|
|
OpenTelemetry debug mode must expose correlated spans for IPC, agents, navigation,
|
|
network/DNS, document/OCR/YARA/semantic inspection, policy handling and management
|
|
requests, including durations and named code stages. Debug collection is centrally
|
|
managed, bounded and disableable. Operational spans do not silently become a raw
|
|
content or credential archive. Backend tracing and collector/SIEM permissions,
|
|
encryption and retention must complete the end-to-end pipeline.
|