Module workload 

Agent identities for platform workloads: the RFC 7523 JWT-bearer grant on /v1/token.

An app instance (usually the AgentVisor sidecar beside it) proves its Cloud Foundry instance identity with an assertion signed by the instance key (see av_identity::workload). The gateway maps the proven app, space, and organization to one configured [[workload_identities]] entry, which names the human principal the agent acts for, its charter, and its scopes, and returns a short-lived agent token signed with the gateway’s exchange key. The gateway’s own identity validator trusts that key and issuer, so the token works on every route like an identity provider’s token: it expires, it can be revoked (by jti, or by the instance GUID in instance_uid), and its sub is the human.

Structs

WorkloadIssuer

Verifies workload assertions and maps them to configured workloads.

Functions

issuer

Issuer of gateway-issued agent tokens.

trust_gateway_tokens

Make validator accept agent tokens this gateway issues: trust the exchange signing key under its key id and, when an issuer allowlist is configured, add the workload issuer to it. No-op without [workload_identity].

Type Aliases

SharedWorkloadIssuer

Shared pointer type stored in the application state.