What a hospital credential breach teaches about ambient authority

Large healthcare systems have lived through credential-vault and identity-provider incidents where the painful part was not only exfiltration (it was that stolen material kept working). An API key, a service password, or a long-lived token authorizes from anywhere until someone notices and rotates.

ENI6MA’s answer is structural, not procedural. The unit of authority becomes the envelope: method, endpoint, request hash, policy hash, tau, and a single-use nonce, validated only after the nonce is burned. Capture of a used envelope is not possession of lasting capability.

For a hospital architecture that already runs PKI and mTLS, coexistence is intentional: keep the certificates for transport identity; put Gate in front of the routes that change clinical or billing state. Migration can start in audit or shadow mode on high-risk endpoints, then flip to proof-required without a big-bang password reset.

This post is not a dump of residual risk or a public threat model. Deployment-specific mappings belong in the Deployment Security Package for qualified evaluators. The public takeaway is simpler: ambient credentials are the breach pattern; one-shot, request-bound proofs are the replacement.

If you protect agent tools or MCP servers that can write to EHR-adjacent systems, the same lesson applies with a larger blast radius (every tool call should carry its own spent authority).