Is your feature request related to a problem? Please describe
Today, access control for agents is coarse-grained and operates at two fixed levels: Privileged (full access) and Limited (Knowledge Base + Metrics only). There is no mechanism to define permissions at a granular, per-agent or per-resource level.
This becomes a blocker in scenarios where finer control is needed. For example, the Agent A may want to grant specific users access to carry out the functionality while restricting access to Agent B — this is currently not possible within the existing authorization model.
As the number of agents and use cases grows, this blanket approach creates two compounding risks:
- Over-permissioning — users are granted more access than they need, increasing blast radius in case of misuse or compromise.
- Under-permissioning — users are denied access to resources they legitimately need, because the only alternative is granting full privileged access.
The system lacks the flexibility to express and enforce fine-grained, resource-level access policies on a per-agent basis.
Additionally, OSCAR currently has no way to map a user's Slack identity to their GitHub handle. Since OSCAR operates within Slack but various agents such as Jenkins, Advisories, etc use GitHub for auth, this identity gap makes it impossible to enforce access policies tied to GitHub-based roles, team memberships, or contributor status.
Describe the solution you'd like
Fine-grained authorization model
Introduce a fine-grained authorization model that allows each agent to define its own access policies at the agent/resource level, scoped to individual users or groups — anchored by a reliable mapping between Slack user IDs and GitHub handles.
1. Identity Mapping: Slack ↔ GitHub
Before any resource-level authorization can be enforced, OSCAR needs a reliable way to know who is making a request in terms the broader system understands.
2. Per-Agent Resource-Level Access Control
Replace the two-tier blanket model with an agent-scoped permission layer, where each agent owns and manages a set of resource-level permissions independently. Access is granted explicitly per resource, per principal (Slack user, GitHub handle, or GitHub team).
Key Design Principles
- Least Privilege by default — no access unless explicitly granted
- GitHub as the source of truth — permissions are tied to GitHub handles and team memberships, consistent with how the OpenSearch project is managed
- Agent ownership — each agent controls its own permission manifest
- Composable — users hold different permissions across different agents independently
- Auditable — all access decisions are logged for traceability
What Changes
- A Slack-to-GitHub identity mapping store is introduced as a foundational layer
- The existing Privileged / Limited tiers remain as convenience presets for simple cases
- Agents that need fine-grained control opt into the permission mode
Is your feature request related to a problem? Please describe
Today, access control for agents is coarse-grained and operates at two fixed levels: Privileged (full access) and Limited (Knowledge Base + Metrics only). There is no mechanism to define permissions at a granular, per-agent or per-resource level.
This becomes a blocker in scenarios where finer control is needed. For example, the Agent A may want to grant specific users access to carry out the functionality while restricting access to Agent B — this is currently not possible within the existing authorization model.
As the number of agents and use cases grows, this blanket approach creates two compounding risks:
The system lacks the flexibility to express and enforce fine-grained, resource-level access policies on a per-agent basis.
Additionally, OSCAR currently has no way to map a user's Slack identity to their GitHub handle. Since OSCAR operates within Slack but various agents such as Jenkins, Advisories, etc use GitHub for auth, this identity gap makes it impossible to enforce access policies tied to GitHub-based roles, team memberships, or contributor status.
Describe the solution you'd like
Fine-grained authorization model
Introduce a fine-grained authorization model that allows each agent to define its own access policies at the agent/resource level, scoped to individual users or groups — anchored by a reliable mapping between Slack user IDs and GitHub handles.
1. Identity Mapping: Slack ↔ GitHub
Before any resource-level authorization can be enforced, OSCAR needs a reliable way to know who is making a request in terms the broader system understands.
2. Per-Agent Resource-Level Access Control
Replace the two-tier blanket model with an agent-scoped permission layer, where each agent owns and manages a set of resource-level permissions independently. Access is granted explicitly per resource, per principal (Slack user, GitHub handle, or GitHub team).
Key Design Principles
What Changes