Repository navigation
profile: Outline how agents get inference without holding credentials - #2
Open
cgwalters-bot wants to merge 1 commit into
Open
cgwalters-bot wants to merge 1 commit into
cgwalters-bot wants to merge 1 commit into
Conversation
The operator plans to use the credential broker outside this bot, so the organization's front page should say in a few lines how the pieces fit: the broker holds the provider credentials, and each CI run gets a short-lived, capped token after proving its identity. Assisted-by: https://github.com/cgwalters/cgwalters#llms
cgwalters
enabled auto-merge (rebase)
October 20, 2026 19:56
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a short section to the organization README: the agents' CI jobs never hold a provider credential. A Praxis-based credential broker holds them, and each run proves its identity with the CI system's identity token, then gets a capped token that is good for that run only. It links to the broker and to agentic-job's inference docs for details, and leaves out deployment specifics.
Generated-by: https://github.com/cgwalters/#llms