CAIN-42 MCPGateCAIN-42 · E53 · global control plane
Fleets, tenants, delegation and revocation that reaches execution.
Not a fleet dashboard. A control plane that resolves the tenant server-side, enforces stricter-wins policy, attenuates delegated authority, records every administrative action in a hash chain, and proves revocation by refusing a protected side effect after the revocation.
10,000
agents registered in 0.123 s (inventory)230.6/s
authorize + execute, in-process567 ms
org-wide revocation over 10k rows0
cross-tenant reads or writes in tests0
self-approvals acceptedWhat is enforced
| Control | Behaviour |
|---|---|
| Tenant isolation | org resolved from the authenticated actor; every query scoped; no caller-supplied tenant is trusted |
| Policy hierarchy | org → fleet → agent; allow intersect, deny/mandatory_deny union, max amount min; versions must increase |
| Delegation | subset actions, amount/expiry non-expanding, depth ≤ 3, no cycles, revocation and expiry checked |
| Approval | distinct approvers, no self-approval, digest-bound, expiring |
| Lifecycle | 12 states with an explicit transition table; illegal transitions refused |
| Revocation | agent/fleet/org scope; capability epoch advanced at the boundary; unacknowledged is reported, not hidden |
| Bulk | preview, whole-batch scope validation, 1,000 limit, idempotent, audited |
Revocation is proven, not displayed
authorize file.write -> capability issued revoke org -> enforcement hook advances the revocation epoch execute -> DENY CAPABILITY_REVOKED oracle -> protected file unchanged
The test asserts the file does not exist after the denied execution. A status field changing is not the proof; the refused side effect is.
Measured (local, one process, SQLite)
| Test | Result |
|---|---|
| inventory 1,000 / 5,000 / 10,000 | 0.009 / 0.060 / 0.123 s |
| first page at 10k | 23.9 ms |
| authorization + execution | 230.6 decisions/s (1,000 in 4.336 s) |
| bulk suspend 1,000 | 120.8 ms |
| org revocation, 10k rows | 567 ms |
Do not read this as 10,000 concurrent agents. It is registered inventory in one process with no HTTP, no concurrency and no multi-region overhead. The report says so.
Honest gaps
- No HTTP control-plane API in this release; the implementation is a Python library (`cain.controlplane`).
- No multi-region control plane. SQLite is a single writer; a regional failure is not survived.
- Cross-organization trust/delegation is not implemented.
- Offline enforcement nodes can use a capability until TTL expiry; that window is documented, not eliminated.
- No database-per-tenant; a compromised process sees all tenants.
Try it
pip install cryptography httpx pytest python3 -m pytest tests/test_evolution53_controlplane.py -q python3 scripts/controlplane/bench.py