RFC 9987: Secure Shell (SSH) Agent Protocol

6 hours ago

The document specifies a key agent protocol for use in the Secure Shell (SSH) protocol, enabling clients to interact with a key management component that holds private keys.
The protocol is a packetised request-response system driven solely by the client, with messages for loading, removing, listing, and using keys, as well as locking/unlocking the agent.
Keys can be added with optional constraints such as lifetime or user confirmation, and agents may support only a subset of key types or refuse operations in certain contexts.
Agent forwarding over SSH connections is supported, allowing remote systems to use stored keys without exposing key material, but caution is advised due to transitive trust.
Security considerations emphasize protecting agent access via permissions, preventing memory theft, mitigating side-channel attacks, and guarding against brute-force lock attempts.

On-call engineers often need privileged access to production databases or servers, but manual credential sharing is inefficient and insecure.
Infisical PAM provides secure, fast access to sensitive resources without requiring agents on every target—just a single lightweight gateway per network.
Access is just-in-time and never exposes the credential to the user; it automatically expires and is scoped to least privilege.

This document proposes best practices for authentication and authorization of AI agents by leveraging existing standards (e.g., WIMSE, OAuth 2.0, SPIFFE) rather than defining new protocols.
AI agents are defined as workloads that interact with LLMs, tools, services, and resources; they require unique identities, short-lived cryptographic credentials, and runtime credential provisioning with posture assessment.
The Agent Identity Management System (AIMS) is a conceptual model comprising identifiers, credentials, provisioning, authentication, authorization, observability/remediation, policy, and compliance.

WebSockets allow real-time two-way communication with a web server, reducing overhead compared to standard HTTP.
The client-side implementation involves creating a WebSocket object, setting up event listeners for open, close, error, and message events, and handling them with appropriate functions.
The chat client UI includes a chat output area, username and message input fields, and a Send button, with auto-scrolling and HTML sanitization to prevent XSS attacks.

Axtary authorizes AI agents by verifying exact action payloads (diff, message, query, tool payload) before execution.
Routine actions follow deterministic policy; higher-risk actions require human approval of the exact payload, bound to its hash.
The system records every attempt in a ledger; approval is tied to the payload, not a summary, preventing changes after review.

AI agents are evolving to perform actions on behalf of users, necessitating a new security model for credential access.
1Password for Claude enables secure credential usage without exposing passwords or one-time codes to the AI model, using a zero-exposure architecture.
Users approve credential requests via biometric authentication, and 1Password injects credentials directly into web pages, ensuring secrets remain encrypted and controlled.

On-call engineers often need privileged access to production databases or servers, but manual credential sharing is inefficient and insecure.
Infisical PAM provides secure, fast access to sensitive resources without requiring agents on every target—just a single lightweight gateway per network.
Access is just-in-time and never exposes the credential to the user; it automatically expires and is scoped to least privilege.

This document proposes best practices for authentication and authorization of AI agents by leveraging existing standards (e.g., WIMSE, OAuth 2.0, SPIFFE) rather than defining new protocols.
AI agents are defined as workloads that interact with LLMs, tools, services, and resources; they require unique identities, short-lived cryptographic credentials, and runtime credential provisioning with posture assessment.
The Agent Identity Management System (AIMS) is a conceptual model comprising identifiers, credentials, provisioning, authentication, authorization, observability/remediation, policy, and compliance.

WebSockets allow real-time two-way communication with a web server, reducing overhead compared to standard HTTP.
The client-side implementation involves creating a WebSocket object, setting up event listeners for open, close, error, and message events, and handling them with appropriate functions.
The chat client UI includes a chat output area, username and message input fields, and a Send button, with auto-scrolling and HTML sanitization to prevent XSS attacks.

Axtary authorizes AI agents by verifying exact action payloads (diff, message, query, tool payload) before execution.
Routine actions follow deterministic policy; higher-risk actions require human approval of the exact payload, bound to its hash.
The system records every attempt in a ledger; approval is tied to the payload, not a summary, preventing changes after review.

AI agents are evolving to perform actions on behalf of users, necessitating a new security model for credential access.
1Password for Claude enables secure credential usage without exposing passwords or one-time codes to the AI model, using a zero-exposure architecture.
Users approve credential requests via biometric authentication, and 1Password injects credentials directly into web pages, ensuring secrets remain encrypted and controlled.

Hasty Briefsbeta