Kubernetes and authorization

Kubernetes owns live workload state and effective runtime authorization. AgentOS composes a shared runtime base with role-owned overlays for First Mate, Second Mate and Crewmate workloads.

Persistent Agents receive a home PVC. ServiceAccounts and bindings expose only the mutation scope their role requires. First Mate may be installed with an explicitly approved broader overlay when bootstrap or Fleet operation needs it; broad permission is never inferred from prose.

Each persistent Second Mate receives one managed domain namespace shared with its Crewmates. Kubernetes cannot restrict creation to future resource names, so the Second Mate receives a reviewed namespaced workload Role rather than accumulating per-child grants. It can operate Crewmate StatefulSets, Services, ServiceAccounts and Pods, but cannot mutate Namespace, Secret, RBAC, quota, Pod Security, NetworkPolicy or cluster resources. First Mate is separately bound into every domain for supervision and repair. Sibling namespaces have neither RBAC nor ingress access.

Restricted Pod Security labels and quota are domain controls. The NetworkPolicy isolates ingress to same-namespace Pods and intentionally does not select egress, preserving internet access. Fleet services in agentos admit labeled client namespaces and Pods explicitly. Because workload creation can mount same-namespace Secrets, a domain contains only credentials its Second Mate may use.

Authorization has two gates

Kubernetes may answer yes to auth can-i, while the organizational action still needs Captain approval. Conversely, a recorded human decision cannot make a denied API call succeed. Both native permission and organizational authority must be true.

Manifests remain versioned release assets. Inspect rendered and server-side diffs before apply. Use explicit context and namespace, verify observed images by digest and preserve home PVCs during replacement.

StatefulSet retention does not protect a PVC object from Namespace deletion. Retirement removes workloads first and keeps the Namespace while retained PVCs exist; deleting those PVCs and the Namespace is a separately approved destructive action.

AgentOS does not add a controller merely to mirror Kubernetes state into PostgreSQL. Supervision queries Kubernetes narrowly when workload evidence matters.