How must an instance verify identity after detecting a credential leak that has not yet been revoked?

**Date of Record:** 2026 October 27 **Scope:** Applies when an agentic session suspects or confirms that its credential has leaked (via logging, network inspection, or peer notification), but the credential has not yet been revoked by the identity provider, and the session must continue operating without exposing the leak further. Does not apply to sessions with hardware-bound credentials that cannot leak, or sessions that can immediately rotate credentials.

Core Distinction

The separation between **credential validity** (the credential has not yet been revoked by the issuer) and **credential safety** (the credential has not been leaked to unauthorized parties). Relying on validity creates the **Leak Window Exposure**: the instance continues using the credential normally, unaware that an attacker holding a copy is also using it, and every action the instance performs is indistinguishable from the attacker's actions to the identity provider.

What Was Observed

In agent architectures with leaked credentials, failing to operate safely during the leak window produces three primary failure modes:

  1. **Concurrent Impersonation:** The attacker uses the leaked credential simultaneously with the legitimate agent, and the identity provider logs appear to show a single principal performing actions in parallel.
  2. **Repudiation Loss:** The agent performs a legitimate action, but an attacker also performs a malicious action with the same credential. The agent cannot prove the malicious action was not its own.
  3. **Amplified Damage:** The agent continues to use the leaked credential for sensitive operations, increasing the blast radius if the attacker's use triggers a detection that revokes the credential mid-operation.

Recorded Elements

  1. **`leak_detection_receipt`:** The cryptographic proof of when and how the leak was detected, establishing the exact window during which the credential is untrusted.
  2. **`concurrent_use_nonce_chain`:** A cryptographic chain of nonces, each action incrementing the chain, so the legitimate agent can detect when the attacker (who lacks the chain state) sends actions with a nonce gap.
  3. **`attribution_signature_chain`:** Every action is signed with a fresh ephemeral key that is bound to the credential via a short-lived attestation, so the agent's actions are distinguishable from the attacker's at the log level.
  4. **`leak_containment_directive`:** The fail-closed instruction (halt sensitive operations, rotate credentials, or escalate) triggered when the leak is detected.

Condition of Validity

* **Applies when:** The credential can be leaked, the leak may not be immediately detectable by the identity provider, and the agent must operate during the leak window. * **Does not apply when:** The credential is hardware-bound (TPM, HSM, secure enclave) and cannot be extracted, or the leak triggers immediate revocation before the agent operates again.

Decision Boundary

  1. **Has a credential leak been detected?** If no, standard credential use applies. If yes, proceed.
  2. **Is a `concurrent_use_nonce_chain` in place?** If no, the agent cannot detect concurrent use. It must implement the chain before the next action.
  3. **Does the next action's nonce match the expected chain?** If no, either the agent's state is corrupted or the attacker has used a nonce. Halt and escalate.
  4. **Conversely, when can the agent continue without nonce chains?** Only when the agent can immediately rotate the credential (within seconds) and the leak window is bounded, or when the actions are strictly non-destructive/read-only.

Operational Effect

  1. **Concurrent Use Detection:** Catches the attacker's actions by detecting nonce gaps in the shared credential use.
  2. **Attribution Preservation:** Ensures the agent's actions are distinguishable from the attacker's in the identity provider's logs.
  3. **Blast Radius Reduction:** Triggers fail-closed behavior, preventing further sensitive operations under the compromised credential.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class LeakWindowVerdict(Enum):
    CREDENTIAL_SAFE = auto()
    NONCE_CONTINUITY_MAINTAINED = auto()
    NONCE_GAP_DETECTED = auto()
    LEAK_CONTAINMENT_REQUIRED = auto()

@dataclass(frozen=True)
class CredentialState:
    credential_id: str
    leak_detected: bool
    last_used_nonce: int
    current_action_nonce: int
    credential_rotation_possible: bool

@dataclass(frozen=True)
class LeakPolicy:
    allow_readonly_under_leak: bool

@dataclass(frozen=True)
class LeakManifest:
    verdict: LeakWindowVerdict
    directive: str
    manifest_digest: str

class LeakedCredentialGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_action(
        cls, state: CredentialState, policy: LeakPolicy
    ) -> LeakManifest:
        
        # Gate 1: No leak
        if not state.leak_detected:
            digest = cls._hash(json.dumps({
                "credential": state.credential_id,
                "status": "SAFE"
            }, sort_keys=True))
            return LeakManifest(
                verdict=LeakWindowVerdict.CREDENTIAL_SAFE,
                directive="PROCEED: No credential leak detected.",
                manifest_digest=digest
            )

        # Gate 2: Nonce gap
        if state.current_action_nonce <= state.last_used_nonce:
            return LeakManifest(
                verdict=LeakWindowVerdict.NONCE_GAP_DETECTED,
                directive=f"HALT: Nonce {state.current_action_nonce} <= last {state.last_used_nonce}. Concurrent use possible.",
                manifest_digest=cls._hash(f"GAP:{state.current_action_nonce}")
            )

        # Gate 3: Nonce gap from attacker (skip)
        if state.current_action_nonce > state.last_used_nonce + 1:
            return LeakManifest(
                verdict=LeakWindowVerdict.NONCE_GAP_DETECTED,
                directive=f"HALT: Nonce skip from {state.last_used_nonce} to {state.current_action_nonce}. Attacker likely used intermediate nonce.",
                manifest_digest=cls._hash(f"SKIP:{state.last_used_nonce}:{state.current_action_nonce}")
            )

        # Gate 4: Containment check
        if not state.credential_rotation_possible and not policy.allow_readonly_under_leak:
            return LeakManifest(
                verdict=LeakWindowVerdict.LEAK_CONTAINMENT_REQUIRED,
                directive="HALT: Leak detected, no rotation possible, read-only not allowed. Containment required.",
                manifest_digest=cls._hash(f"CONTAIN:{state.credential_id}")
            )

        # Gate 5: Continuity maintained
        digest = cls._hash(json.dumps({
            "credential": state.credential_id,
            "nonce": str(state.current_action_nonce),
            "status": "NONCE_CONTINUITY"
        }, sort_keys=True))
        
        return LeakManifest(
            verdict=LeakWindowVerdict.NONCE_CONTINUITY_MAINTAINED,
            directive=f"PROCEED_WITH_CAUTION: Nonce continuity maintained at {state.current_action_nonce}.",
            manifest_digest=digest
        )