{"slug": "trusted-ai-agent-transactions-part-5-end-to-end-proof", "title": "Trusted AI Agent Transactions, Part 5: End-to-End Proof", "summary": "A developer has published the final part of a series on trusted AI agent transactions, demonstrating an end-to-end proof that integrates PingFederate, SPIRE, and PingAuthorize to secure agent actions. The implementation uses OAuth 2.0 with PKCE, SPIFFE mTLS, and a transaction token to provide distinct evidence for user, agent, workload, transaction, and caller, with an audit trail that avoids exposing raw tokens. The suite proves rejection of tampered tokens and verifies that no raw token material appears in logs.", "body_md": "The previous articles covered the identity model, [PingFederate token exchange](//02-pingfederate-token-exchange.md), [SPIRE workload identity](//03-spire-workload-identity.md), and [PingAuthorize policy](//04-pingauthorize-policy.md). This final part connects them into one testable application path.\n\nThe browser workbench signs the user in through PingFederate with OAuth 2.0 Authorization Code and PKCE. The application never collects the user's PingFederate password.\n\nAfter sign-in:\n\n`Txn-Token`\n\nheader while calling the MCP gateway over SPIFFE mTLSThe original user access token does not travel beyond the exchange. The Txn-Token does not become a browser session token, does not use the `Authorization`\n\nheader for internal propagation, and is not rewritten by intermediaries.\n\nThe workbench uses two-thirds of the screen for service interaction and one-third for a selectable audit trail. Events correlate the same transaction ID across the agent, gateway, MCP server, API, and authorization decision.\n\nSelecting an event can show safe request and response metadata plus decoded, allowlisted token claims. It must not expose raw access tokens, JWT-SVIDs, transaction JWTs, authorization headers, cookies, authorization codes, client secrets, refresh tokens, private keys, or sensitive tool arguments.\n\nDecoded claims are evidence for a human operator, not a new authorization input. Services authorize only after cryptographic validation.\n\nBoth Ping products use digest-pinned images and read-only repository-owned profile overlays.\n\nPingFederate startup builds and tests the custom token processor plugin. Its Terraform configuration remains a separate explicit step.\n\nPingAuthorize starts with a repository-owned deployment package selected during first setup. The package is mounted read-only, and the container joins only the expected local application bridge network.\n\nSecrets, licenses, generated certificates, private keys, Terraform state, and discovery output remain outside Git.\n\nThe main authorization statement is:\n\n```\nverified transaction context\nAND verified immediate caller\nAND target policy\n```\n\nThe end-to-end suite therefore needs more than a success case. It proves rejection for:\n\nIt also proves that one transaction ID appears across all expected hops and that captured logs contain no raw token material.\n\nThe PingFederate clean-bootstrap test goes further by recreating the product on an isolated volume and Terraform state, applying managed TLS, completing a live exchange, rejecting a tampered actor token, and cleaning only its randomly named resources.\n\nAgent security is not solved by adding an `agent_id`\n\nclaim or passing a user token farther downstream. The implementation needs distinct evidence for the user, logical agent, workload, transaction, and immediate caller.\n\nPingFederate provides the controlled delegation boundary. SPIRE proves runtime identity. PingAuthorize evaluates the verified action context. The gateway preserves the boundary between identity verification, routing, and policy enforcement.\n\nTogether, they make an agent action explainable and testable: who authorized it, which agent was approved, which workload ran it, why the transaction exists, which service made each call, and which policy allowed or denied the operation.\n\nPrevious: [Making policy decisions with PingAuthorize](//04-pingauthorize-policy.md)\n\nReturn to the [series index](//README.md).\n\nGitHub Repository: [https://github.com/darkedges/pf-tts](https://github.com/darkedges/pf-tts)", "url": "https://wpnews.pro/news/trusted-ai-agent-transactions-part-5-end-to-end-proof", "canonical_source": "https://dev.to/darkedges/trusted-ai-agent-transactions-part-5-end-to-end-proof-44b5", "published_at": "2026-08-23 23:03:55+00:00", "updated_at": "2026-08-23 23:14:10.814019+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-infrastructure", "ai-policy"], "entities": ["PingFederate", "PingAuthorize", "SPIRE", "MCP", "OAuth 2.0", "PKCE", "SPIFFE", "darkedges"], "alternates": {"html": "https://wpnews.pro/news/trusted-ai-agent-transactions-part-5-end-to-end-proof", "markdown": "https://wpnews.pro/news/trusted-ai-agent-transactions-part-5-end-to-end-proof.md", "text": "https://wpnews.pro/news/trusted-ai-agent-transactions-part-5-end-to-end-proof.txt", "jsonld": "https://wpnews.pro/news/trusted-ai-agent-transactions-part-5-end-to-end-proof.jsonld"}}