What Is SPIFFE?
SPIFFE (Secure Production Identity Framework for Everyone) is a set of open standards for service identity. A SPIFFE ID is a URI that uniquely identifies a workload. SPIFFE ID structure:
Full example:
What Is an SVID?
An SVID (SPIFFE Verifiable Identity Document) is the cryptographic proof of a SPIFFE ID. Hexr uses two types:Per-Process Identity
Hexr’s key innovation is assigning a unique SPIFFE ID to each process within an agent container — not just the pod:- Per-role cloud access — the researcher can access BigQuery but not S3
- Per-role cost tracking — attribute LLM costs to each role
- Per-role audit logs — know exactly which sub-agent did what
Lifecycle
The complete lifecycle of a SPIFFE identity — from build to cloud access:Build: AST Discovery
hexr build scans your Python source via AST analysis. Discovers all agent roles
(researcher, writer, editor) and generates process context JSON files.Pod starts: SDK installed
Init container installs the Hexr SDK from private PyPI into a shared volume.
PID Mapper: Process registration
When the agent process starts (e.g., “researcher”, PID 42), the PID Mapper reads
/proc,
maps the container PID to the host PID, and writes enriched context JSON.SPIRE: SVID issued
The Auto-Registrar creates a SPIRE entry. SPIRE issues an X.509-SVID with a 5-minute
TTL (auto-renewed at 50% TTL). The SVID contains the per-process SPIFFE ID.
Runtime: mTLS + cloud access
The agent uses its SVID for mTLS (via Envoy) and presents its JWT-SVID to cloud
providers (AWS STS, GCP WIF, Azure) for temporary credential exchange.