Every agent its own identity.
Your IAM decides the rest.
Pick an agent and watch its sandbox's identity travel into Google Cloud, one hop at a time: a one-hour OIDC token, a federated principal, a narrower service account, and BigQuery deciding every read. No key ever enters the sandbox, and the hops that should be refused are.
Follow the identity
Each scenario runs in a real Chalk sandbox launched with that agent's own service token, and every hop is a live call to Chalk, Google STS, IAM Credentials and BigQuery. The release agent can read deploy metrics but not customer payments. The unvetted agent cannot borrow the release agent's service account. A token minted for another audience is turned away at the door.
Six hops, no keys
Chalk is the identity provider; your cloud is the authority. Workload identity federation connects the two with short-lived tokens, so access stays where your security team already manages it.
Launch
A sandbox started with chalk_identity=True carries the identity of whoever launched it: a person, or an agent's own Chalk service token. Nothing else is mounted.
Mint
Inside the sandbox, the agent asks Chalk for a one-hour OIDC token for one audience. Its subject names the environment and the launcher, so your cloud knows exactly who is asking.
Exchange
Your cloud's token service checks Chalk's signature, the audience and your pool condition, then hands back a federated token. A token minted for any other audience is refused.
Narrow
The federated principal can act as one existing service account, or read what you granted it directly. Each hop is shorter-lived and narrower than the one before.
Decide
Your IAM decides every read. In the demo, BigQuery refuses the customer table outright, and the unvetted agent is refused the release agent's service account.
Audit
Cloud Audit Logs record the federated subject, environment and token id included, on every call it makes directly, and the service account on calls it makes as one.
One pool, a few bindings
Register Chalk as an OIDC provider in a workload identity pool, then bind the subjects you trust: a developer, an agent's service token, or a whole Chalk environment. Launch sandboxes with chalk_identity=True and they can reach exactly what those bindings allow.
Removing a binding or a token cuts access within the hour, the longest any token in the chain lives.
chalk-ai/sandbox-identity-federationimport chalkcompute
# The sandbox's identity is whoever launches it: a person, or the agent's own service token.
sandbox = chalkcompute.Sandbox(
image=chalkcompute.Image.debian_slim("3.12").pip_install(["chalkcompute"]),
chalk_identity=True,
# Egress only to Chalk and the Google APIs the agent needs.
network_policy=chalkcompute.NetworkPolicy(allowed_hosts=[
"api.chalk.ai",
"sts.googleapis.com",
"iamcredentials.googleapis.com",
"bigquery.googleapis.com",
]),
).run()
sandbox.exec("python", "agent.py")Agents with scoped access
Coding and ops agents need real data and real systems. Give each one an identity of its own, and let the permissions you already manage decide what it can touch.
No keys in the sandbox
The sandbox never holds a cloud key or a long-lived secret. Credentials are minted per hop and expire within the hour.
Per person, agent or environment
Bind a developer's subject, an agent's service token, or a whole Chalk environment. New users in an environment need no IAM change.
Your IAM stays in charge
Access lives in your cloud's IAM and your Terraform. Chalk provides the identity; it does not need its own copy of your permissions.
Reuse your service accounts
Let a Chalk identity act as a service account you already have, and every role on it carries over unchanged.
Standard OIDC
Any service that trusts an OIDC issuer can verify the token against Chalk's published keys, not only Google Cloud.
Open source
The demo server, the in-sandbox agent, and the setup script for your own project are Apache-2.0 on GitHub.
Give your agents an identity you can audit
Talk to an engineer about running sandboxes in your cloud with identities that map onto the IAM you already have.