Attacks · By business pattern
Tool-call authority for agents without reusable secrets. Clone and copy stop converting into lasting MCP blast radius when each call spends a bound envelope.
~6 min readRelated: APIs pattern
Agent attackers exfiltrate tool secrets or replay tool calls to expand blast radius across MCP surfaces. The deployment question is whether a cloned agent still carries lasting ambient authority for every tool after config copy, prompt leak, or env dump.
Agent stacks often embed API keys in prompts, env, or tool configs. Possession scales with every clone. Ambient agent security recreates the API-key problem inside orchestration layers: stolen config equals lasting caller rights until someone rotates the secret.
Per-call proofs at the tool boundary mean no ambient tool secret to steal, burn-before-validate on replay, and binding on retarget. Same families as APIs - expressed for agent orchestration. Deep-link ambient, replay, and relay for dual plates that show conversion denial without residual sidebars.
Treat MCP tool chips as actions that must earn envelopes, not as containers for long-lived keys. Authority expires per request under claim-scoped language on Claims.
Bearer lives outside the request
How to read: long-lived bearers left; possess-once call-many ambient win. Takeaway: authority survives the call.
Ambient agent success is the cloned config that keeps calling tools.
Authority dies with the request
How to read: ambient myths fail; per-request proof and burn succeed. Takeaway: no long-lived bearer on the channel.
Per-call envelopes remove the reusable tool bearer from clone and copy paths.
Every API key, bearer token, and service certificate is a secret that works from anywhere until you notice it is gone.ValidatedAmbient credentials authorize by possession alone; ENI6MA replaces that model with one-shot, request-bound proofs.
Authority expires at the end of each request.ShippingThe envelope binds method, endpoint_id, request hash, policy hash, tau, and nonce (one message, one use).Holds under the reference architecture
Tool calls spend nonces.
Bound to the named tool route.
No lasting tool bearer.
This white paper introduces ENI6MA as a stateless, witness-driven proof-of-knowledge architecture that replaces long-lived secrets with ephemeral, time-coupled evidence. Five cooperating strata cover a two-way hash keystream, entropy-pool sealing, a deterministic runtime loader, session entropy and offset computation that rotates concentric alphabet rings, and a control matrix that extracts per-round offsets for a six-zone manifold.
