docs(mcp-gateway): outbound credential brokering + dynamic short-lived credentials (PR 4e)#629
Open
EliMoshkovich wants to merge 1 commit into
Open
docs(mcp-gateway): outbound credential brokering + dynamic short-lived credentials (PR 4e)#629EliMoshkovich wants to merge 1 commit into
EliMoshkovich wants to merge 1 commit into
Conversation
…d credentials (PR 4e) New Outbound Credentials page: the gateway brokers agents' outbound API credentials — per-request injection + response scrubbing, plus dynamic short-lived issuance (AWS STS temporary credentials via SigV4, OAuth access tokens minted from a vaulted refresh token that never leaves the gateway). Cross-linked from Advanced Features + maturity table; cspell terms added. Companion to agent-security PR #295 (PER-14853 PR 4e). Push/PR deferred to batch the full PER-14853 customer-docs work.
✅ Deploy Preview for permitio-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds customer-facing documentation for Permit MCP Gateway’s new outbound credential brokering behavior, including dynamic short-lived credential issuance (AWS STS + OAuth) and cross-linking from existing “Advanced Features” docs.
Changes:
- Added a new
Outbound Credentialsguide describing static secret injection, AWS STS assume-role + SigV4 signing, and OAuth access-token minting from a vaulted refresh token. - Updated the “Advanced Features” page with a new “Outbound Credential Brokering” section and a corresponding Feature Maturity Summary row.
- Extended
cspell.jsondictionary with new technical terms used by the docs.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| docs/permit-mcp-gateway/outbound-credentials.mdx | New dedicated documentation page for outbound credential brokering and dynamic credential issuance. |
| docs/permit-mcp-gateway/advanced-features.mdx | Adds cross-linking section + maturity table entry for outbound credential brokering. |
| cspell.json | Adds spell-check allowlist entries for new terminology (SigV4, IRSA, HashiCorp, EKS). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Companion customer-docs for agent-security PR #295 (PER-14853, PR 4e — Dynamic / Short-Lived Credential Issuance). The gateway can now mint short-lived, identity-scoped credentials for agents' outbound API calls instead of storing a long-lived secret — a customer-facing behavioral change that needs documentation.
Linear: PER-14853.
What
docs/permit-mcp-gateway/outbound-credentials.mdx(sidebar 8.5): documents the gateway as an outbound credential broker — the agent never holds the upstream secret; the gateway injects it per request, authorizes the destination against policy, and scrubs the credential from the response. Covers the three credential types:MaxSessionDuration).advanced-features.mdx: new "Outbound Credential Brokering" section cross-linking the page + a Feature Maturity Summary row.cspell.json: addedSigV4,IRSA,HashiCorp,EKS.How it was tested
Docs-only. Verified internal links resolve to existing pages (
human-in-the-loop,enterprise-deployment, the newoutbound-credentials), frontmatter matches the existingpermit-mcp-gatewaypages, and added the new technical terms tocspell.jsonso the spell-check passes. No emojis; Docusaurus admonitions used per house style.Notes
Dynamic issuance is flagged as an Enterprise capability under active development; static credential injection + response scrubbing are described as available today. Phrasing is intentionally conservative on maturity, matching the surrounding Advanced Features page.
🤖 Generated with Claude Code