Architecture d'identité Zero Trust pour agents IA avec validation JWT, échange de jeton OBO à portée limitée, identité de charge SPIFFE/SVID et autorisation d'outil MCP.

Code FlowZap complet

User { # User
n1: circle label:"Start"
n2: rectangle label:"Send request + user JWT"
n3: rectangle label:"Receive approval"
n4: circle label:"End"
n1.handle(right) -> n2.handle(left)
n2.handle(bottom) -> AgentPlatform.n5.handle(top) [label="User JWT"]
n3.handle(right) -> n4.handle(left)
}

AgentPlatform { # Agent Platform
n5: rectangle label:"Validate JWT + agent ID"
n6: rectangle label:"Exchange for scoped OBO token"
n7: rectangle label:"Receive tool result"
n8: rectangle label:"Return approval"
n5.handle(right) -> n6.handle(left)
n6.handle(bottom) -> MCPTool.n9.handle(top) [label="Scoped OBO token"]
n7.handle(right) -> n8.handle(left)
n8.handle(top) -> User.n3.handle(bottom) [label="Approved"]
}

MCPTool { # MCP Tool
n9: rectangle label:"Validate scoped token"
n10: rectangle label:"Check SPIFFE SVID"
n11: rectangle label:"Execute tool call"
n12: rectangle label:"Return tool result"
n9.handle(right) -> n10.handle(left)
n10.handle(right) -> n11.handle(left)
n11.handle(right) -> n12.handle(left)
n12.handle(top) -> AgentPlatform.n7.handle(bottom) [label="Result"]
}

Modèles associés