saligrama

Yes, exactly, a cloud agent always authenticates itself (via OIDC) as an agent (machine) identity, with the option for the identity of the human who launched it to ride along.

We then have the ability to enforce (extremely fine grained) policies based on that combined identity, plus any of the claims in the OIDC token (e.g., the repo URL), plus any of the data on the protocol itself (e.g., block non-read-only queries; redact anything sensitive).

https://docs.formal.ai/docs/guides/policies/introduction

Yes, exactly, a cloud agent always authenticates itself (via OIDC) as an agent (machine) identity, with the option for the identity of the human who launched it to ride along.

We then have the ability to enforce (extremely fine grained) policies based on that combined identity, plus any of the claims in the OIDC token (e.g., the repo URL), plus any of the data on the protocol itself (e.g., block non-read-only queries; redact anything sensitive).

https://docs.formal.ai/docs/guides/policies/introduction

Baserunner [1] does exactly this. I described using it for Firebase security research in my blog post [2].

[1] https://github.com/iosiro/baserunner

[2] https://saligrama.io/blog/post/firebase-insecure-by-default/