WARDEN

Use cases

SRE agents — incident-response agents reaching Prometheus, Grafana, Kubernetes, and PagerDuty under one policy layer. Warden scopes each call to the agent's identity — query dashboards but not delete them, restart a pod but not modify IAM. Every action during an incident is tied to the agent's identity in the audit log.

Agentic coding — code agents that push to GitHub, deploy to AWS, and read from artifact stores all through one identity. Warden enforces which repos they push to, which buckets they read, and logs every action.

RAG pipelines — retrieval agents reaching production databases and object stores under per-request grants. Warden vends a database auth token or pre-signed URL scoped to the exact query or object the agent needs.

Multi-model orchestration — an agent reaching Anthropic for reasoning, OpenAI for embeddings, and Mistral for classification through one identity, one policy layer, and one audit log across all three.

MCP servers — point the MCP server at Warden instead of the upstream API. The MCP server authenticates with its identity, Warden brokers the connection, and the same gateway covers every tool the server exposes — replacing the per-tool-credential-in-env model with one identity and one policy surface.

Autonomous workflows — long-running agents that reach systems over hours or days with time-scoped access. Warden issues credentials per request, so no token outlives the work it was minted for.

Warden also secures non-agent workloads — CI/CD pipelines, microservices, developer machines — with the same identity-based model.

Tutorials

AWS access hygiene — per-call least privilege, mid-task. A Goose agent audits IAM in a sandbox AWS account through four read-only lenses (inventory, recent usage, external exposure, effective access) and publishes findings to Security Hub and a Slack canvas — switching Warden roles between every call so each operation runs under exactly the role it needs and nothing more. A hallucinated securityhub:BatchImportFindings attempted under the read intent is denied at AWS by the assumed role's narrow IAM policy — not by Warden — and surfaces in the audit log as the declared intent on a mismatched action. See the walk-through.

Vault policy hygiene — one identity, three systems, zero credentials. A Goose agent audits OpenBao ACL policies, reasons over them with an Anthropic-compatible LLM, and publishes the report to Slack — all under one Forgejo OIDC JWT, all through Warden. Sibling demo of the same discover-and-connect pattern, exercising the across-providers axis (one Vault role for the audit, one Slack role for delivery). See the walk-through.

In both tutorials the agent's recipe contains no URLs, no role names, no channel IDs, no account IDs. The runtime hands it three env vars and a JWT; the agent asks Warden what's wired up for its identity and picks the right combination by reading operator-set descriptions. Rename a role, swap the LLM, move to a different cluster — the recipe doesn't change.

For the system-side reference — the runtime contract, the discovery loop, error handling — see docs/agent-flow.md.