VAREXIS-INDEX ยท Free evidence

Agent identity and delegation continuity evidence

38 source-linked reviews of distinct agent identity, delegated authority, task outcome and reconciliation decisions. Review dated sources and required evidence. Documentation does not establish live behaviour, authorization, settlement, deletion or certification.

Catalogue additions are available free through the exact HTTP JSON links below. Enhanced natural-language discovery is not yet qualified for these records. They are outside MCP search, MCP preview and paid saved retrieval. No search qualification, executable capability or entitlement is added.

Complete exact-ID manifest · Full catalogue · Existing MCP coverage

Where must an Entra agent identity obtain its authentication credentials

Where must an Entra agent identity obtain its authentication credentials?

The agent identity has no credentials of its own. Its blueprint holds credentials and acquires tokens on its behalf, subject to relevant consent. Review both objects and their credential relationship.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Do not accept an agent identifier alone as proof of a usable, authorized credential path.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Can a multitenant Entra blueprint make one child identity valid across tenants

Can a multitenant Entra blueprint make one child identity valid across tenants?

No. Agent identities remain single-tenant. A multitenant blueprint can be installed elsewhere and create separate tenant-local identities; it does not make an existing child identity cross-tenant.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Require the destination tenant identity and authorization evidence.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Can an Entra child-agent permissions listing establish complete inherited scope

Can an Entra child-agent permissions listing establish complete inherited scope?

No. Microsoft states inherited permissions are not shown on the agent identity in the admin center or Graph. They merge with direct grants at token issuance and are observable in token contents.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Use a safely inspected claim summary plus grant evidence; never publish or request the token itself.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Can an Entra sponsor restore an agent after disabling it

Can an Entra sponsor restore an agent after disabling it?

Sponsors can disable or soft-delete an agent and change its sponsors, but cannot re-enable or restore it. Recovery needs an owner or administrator. Sponsorship does not confer all owner powers.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Route recovery to an authorized owner or administrator.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Does a dynamic-group membership change immediately authorize agent sponsor actions

Does a dynamic-group membership change immediately authorize agent sponsor actions?

Microsoft documents up to 24 hours after a dynamic membership rule or user-property change before sponsorship authorization succeeds. Changed membership alone is insufficient evidence of effective sponsor authority.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Check effective authority before relying on a new sponsor for an urgent operation.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Which identifier receives an autonomous Entra agent app-role assignment

Can a blueprint client ID receive a child agent's resource app-role assignment?

For an application-permission grant to the child agent, the documented assignment uses the agent identity service principal object ID as principalId, the resource service principal object ID as resourceId, and the selected appRoleId. Do not substitute the blueprint client ID. A separate grant to a blueprint for agent-user creation is a different operation.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Require the exact principal/resource/role tuple.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Can administrator consent override Agent ID high-privilege restrictions

Can administrator consent override Agent ID high-privilege restrictions?

The documented agent model blocks specified high-risk Graph permissions and privileged directory roles. Agents also cannot join role-assignable groups. Administrator consent is not a general override.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Check the current permitted roles and permissions; refuse reliance on blocked grants.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Does an Entra agent identity policy also cover its agent-user and delegated-user tokens

Does an Entra agent identity policy also cover its agent-user and delegated-user tokens?

No. Delegated access, app-only agent identity access and agent-user access use different policy targets. A policy targeting the agent identity does not apply to its agent user account, or vice versa.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Map every actual token subject and access pattern to its policy.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Does Entra Conditional Access govern an agent's direct API-key access

Does Entra Conditional Access govern an agent's direct API-key access?

API-key access bypasses Entra authentication and token issuance, so its Conditional Access policies do not apply to that path. Resource-side key controls need separate assessment.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Do not count an Entra policy as coverage for a path outside Entra tokens.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Can an Entra agent user account operate as an ordinary password-based user

Can an Entra agent user account operate as an ordinary password-based user?

The account has restricted credentials tied to its parent agent identity and restricted interactive sign-in. It cannot receive ordinary passwords or passkeys merely because its tokens use a user identity type.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Reject designs requiring a normal interactive account; verify the parent flow.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Does disabling a blueprint affect only future agent provisioning

Does disabling a blueprint affect only future agent provisioning?

No. Microsoft describes blueprint disabling as preventing new agent identities and blocking existing ones. Its scope is broader than disabling one agent.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Inventory affected agents; do not infer immediate revocation of every already-issued external credential.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Whose identity appears when an Entra blueprint provisions an agent

Whose identity appears when an Entra blueprint provisions an agent?

The tenant blueprint principal is referenced by the blueprint token oid and audit records for blueprint operations. That provisioning actor differs from the child performing later resource work.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Preserve both actors; provisioning is not evidence of a child's later action.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Do Agent ID Developer and Administrator permit the same credential changes

Do Agent ID Developer and Administrator permit the same credential changes?

The creation guide permits Agent ID Developer to configure federated identity credentials. Adding a secret or certificate requires Agent ID Administrator. Credential type changes the required administrative authority.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Check the specific credential operation and actor role.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Does an AgentCore vault token prove the provider still accepts it

Does an AgentCore vault token prove the provider still accepts it?

No. Provider-side revocation may be undetected by AgentCore. The documented forceAuthentication option clears stored refresh-token state and initiates fresh authentication; retrieval alone does not establish validity.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Reconcile rejection and reauthorization before retrying consequential work.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Does an AgentCore workload identity automatically isolate its credential provider

Does an AgentCore workload identity automatically isolate its credential provider?

No. The assigned IAM role controls provider access, with no extra workload-provider binding in the same account. Scope resource blocks to the intended ARNs. User-scoped OAuth retrieval still needs the relevant prior authorization.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Inspect IAM resource scope rather than relying on workload or provider names.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Does AgentCore OBO always transmit the same actor evidence

Does AgentCore OBO always transmit the same actor evidence?

No. RFC8693 mode supports an M2M token, an AWS IAM JWT, or no actor_token. NONE relies on the authorization server deriving actor identity from client authentication.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Record the actual mode and provider interpretation before claiming an explicit actor-token chain.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Is an AgentCore user-ID header equivalent to a validated user JWT

Is an AgentCore user-ID header equivalent to a validated user JWT?

No. The header uses the user-ID token path and additionally requires InvokeAgentRuntimeForUser. The JWT path validates issuer, signature and expiry; AWS recommends it with a production identity provider.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Do not describe caller-supplied user labels as cryptographically proven user identity.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Can AgentCore use one OBO wire format for every identity provider

Can AgentCore use one OBO wire format for every identity provider?

No. AgentCore supports RFC8693 token exchange and JWT authorization-grant mode. Provider configuration determines the expected fields; Microsoft's preset adds requested_token_use=on_behalf_of unless overridden.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Require provider-supported grant configuration; OBO labels do not establish interchangeable requests.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Can an enterprise ID-JAG directly serve as an MCP bearer access token

Can an enterprise ID-JAG directly serve as an MCP bearer access token?

In the optional Enterprise-Managed Authorization profile dated 2026-07-28, the enterprise IdP evaluates policy and issues an ID-JAG. The client then presents that intermediate grant to the resource authorization server, which validates it and issues the MCP access token. Corporate sign-in or the ID-JAG alone does not establish a usable resource token; profile support and both trust relationships need evidence.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Require the resource-token exchange and audience validation before protected calls.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Which audience and resource identify an MCP enterprise grant

Which audience and resource identify an MCP enterprise grant?

In the optional pinned 2026-07-28 profile, the token-exchange audience is the resource authorization server's issuer identifier. The optional resource parameter, when supplied, identifies the MCP server. The profile requires the final access token to be restricted to the MCP server identified by the ID-JAG resource claim. Omission does not establish unrestricted access; this source does not resolve every omitted-resource deployment behavior.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Do not substitute the MCP URL for the authorization-server issuer.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Does fetching MCP client metadata establish an acceptable redirect

Does fetching MCP client metadata establish an acceptable redirect?

No. Checks include exact equality of document URL and client_id, required JSON fields, and matching the requested redirect against the document's list. A fetched page or familiar name is insufficient.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Reject mismatches; protocol checks do not certify business trustworthiness.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Can MCP credentials carry over to another advertised authorization server

Can MCP credentials carry over to another advertised authorization server?

Do not assume so. MCP 2026-07-28 requires separate registration state for each authorization server and association of credentials and tokens with the issuing server. An advertised alternative issuer does not establish that it accepts another issuer's credentials.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Require issuer-specific registration and authorization evidence before reuse.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Must an MCP scope challenge be a subset of advertised scopes

Must an MCP scope challenge be a subset of advertised scopes?

No. MCP 2026-07-28 prohibits assuming a set relationship between challenged scopes and scopes_supported, and requires treating the challenge as authoritative for the current operation. For initial authorization it recommends using the challenge scope first; otherwise it recommends advertised scopes, omitting scope when scopes_supported is undefined. This does not itself grant consent.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Use the actual challenge and consent policy, not an assumed discovery-list subset.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Can MCP assume authorization metadata exists only at the domain root

Can MCP assume authorization metadata exists only at the domain root?

No. July 2026 defines ordered OAuth and OpenID discovery candidates for issuers with paths. A root-only probe can miss a tenant issuer; returned issuer metadata still needs validation.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Preserve the issuer path and follow documented discovery before declaring failure.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Does the MCP client-credentials extension use dynamic registration

Does the MCP client-credentials extension use dynamic registration?

The optional pinned 2026-07-28 client-credentials extension requires pre-registered client credentials, typically established out of band through administrative channels, and does not use Dynamic Client Registration in this flow. Adopted implementations retain baseline authorization requirements.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Require supported extension and pre-registration evidence.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Is the MCP client-authentication JWT itself the authorization grant

Is the MCP client-authentication JWT itself the authorization grant?

The pinned specification uses grant_type=client_credentials with a JWT client_assertion for authentication. That differs from a JWT authorization grant. Record the actual grant type and authentication method.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Do not infer wire-format equivalence from JWT presence.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Can two providers in one workload pool map different identities to one principal

Can two providers in one workload pool map different identities to one principal?

Yes. Matching google.subject values across providers can collapse identities into one IAM principal and make them indistinguishable in audit logs. Google recommends one provider per pool to avoid this.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Require collision-resistant pool/subject mappings before asserting unique attribution.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Can user-editable attributes safely anchor workload federation access

Can user-editable attributes safely anchor workload federation access?

Google warns editable attributes can cause access loss or spoofing when mapped to IAM bindings. Use immutable identity attributes rather than values an external user can change.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Reassess user-controlled identity mappings; matching text alone is insufficient.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Can changing federation mappings alter access without editing IAM bindings

Can changing federation mappings alter access without editing IAM bindings?

Yes. A mapping edit can change which external identities match existing service-account bindings. Provider update authority therefore affects effective access even with unchanged bindings.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Review mapping changes alongside grants.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Does account deletion retire a federation binding to a reusable name

Does account deletion retire a federation binding to a reusable name?

Not necessarily. Google recommends non-reusable attributes because a later account can inherit a reused value and match an old binding. Uniqueness must hold over time.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Retire stale bindings or use a non-reassigned identifier; deletion alone is insufficient.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Can a Claude SDK hook allow override a matching deny rule

Can a Claude SDK hook allow override a matching deny rule?

The captured SDK documentation evaluates deny rules after hooks. A matching deny prevents the call and skips canUseTool, even after hook allow or in bypassPermissions mode.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Do not treat hook allow as evidence of authorization or execution.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Can a Claude SDK subagent independently weaken its parent permission mode

Can a Claude SDK subagent independently weaken its parent permission mode?

In the captured documentation, subagents inherit parent plan, acceptEdits, auto or bypassPermissions modes. Under default or dontAsk parents, the configured subagent mode applies, except that Claude Code v2.1.267 and later do not apply a subagent bypassPermissions value; auto applies only where available to that subagent. Inherited bypassPermissions can itself confer broad autonomous access. Check the installed runtime and effective mode.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • Check effective inherited mode and runtime version, not only the subagent field.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review

Does a canUseTool callback review every Claude SDK tool call

Does a canUseTool callback review every Claude SDK tool call?

No. The captured documentation says bypassPermissions or a bare-tool allowedTools entry can approve calls before canUseTool, subject to documented exceptions. The TypeScript SDK warns about these configurations with CLAUDE_SDK_CAN_USE_TOOL_SHADOWED; the warning does not block calls or change options. For checks required on every tool call, the documentation directs developers to PreToolUse hooks.

Documentation reviewed 2026-10-30. Primary source.

Boundaries
  • For every-call inspection use the documented earlier hook boundary; callback installation is not complete coverage.
  • Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
  • No expanded capabilities or licences for existing INDEX executables.

Complete record JSON · Exact free preview JSON · Source review