[phase-2] Policy enforcement inside TEE — Cedar evaluation runs in the enclave, not at API boundary

Aperta
  • Qualcosa non va?
#124 10 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@kingztech2019 ci sta già lavorando.

Dal 7/9/2026.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

attestation phase-2 security

What and why

Phase 1 enforces Cedar policy at the API layer — the gateway process evaluates policy before forwarding calls to upstream MCP servers. In Phase 1, a compromised host OS can still bypass this (it can intercept the gateway process).

Phase 2 moves the Cedar evaluation inside the TEE boundary so policy decisions are hardware-protected. The Cedar engine must run inside the enclave; the policy bundle must be measured into the TEE attestation report; the enforcement result must be signed with the TEE key.

Architecture change

Phase 1 (current):
Agent → [cMCP API layer → Cedar eval → forward] → Upstream MCP server

Phase 2 (target):
Agent → [cMCP API layer] → TEE enclave: [Cedar eval + session state + audit chain] → [forward or deny] → Upstream MCP server

The TEE boundary is at the Cedar evaluation step. The enclave holds:

  • The Cedar policy bundle (loaded and measured at startup)
  • The session state (sensitivity tags, call history)
  • The audit chain (hash-chained, TEE-signed)

Acceptance criteria

  • Cedar evaluation runs inside the enclave — the policy bundle is measured into the TEE attestation report
  • policy.bundle_hash in the TRACE Trust Record is the hash measured at enclave load time (tamper-evident)
  • policy.enforcement_mode = "enforce" means a deny inside the enclave cannot be bypassed by the host
  • All Phase 1 tests continue to pass
  • Conformance tests POLICY-TEE-001 through POLICY-TEE-005 added and passing
  • TRACE Trust Record policy.bundle_hash matches the value measured at startup

Notes

This is the critical path item for the GTC Berlin demo. Without it, the demo shows software-only governance (useful, but not the hardware-proof story). Target: end of Q3 2026.

Lingua principale
Python
Stelle
33
Fork
24
Merge medio
1g 12h
PR unite (30g)
59

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di agentrust-io/cmcp

Tutte le issue di agentrust-io/cmcp

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.