Glossary · sovereign-shield
Sovereign Shield
Definition
Ellul's authentication and credential-brokering layer. Runs in a separate process from the agent, holds session keys and OAuth tokens, and enforces passkey approval for privileged actions. The agent never sees credentials directly. It asks the shield to broker the action, and the shield pauses until a human taps a passkey to approve.
Context
The shield process runs as a different system user with its own group memberships and ptrace restrictions, so an agent running adjacent code on the same workstation cannot read the shield's memory, environment, or git subprocess credentials. Every privileged operation (git push, deploy, database writes, secret reads) flows through the shield, which decides whether it requires a fresh passkey approval based on per-gate TTLs and the action's classification.
Also known as
Related terms
See also