[mashkovd]

Least-privilege credentials for agent runs, stage 1 step 2 (mctlhq/mctl-agents#737): switch the issue investigator's MCP connection from observe to enforce.

Change

cwft-mctl-agents-investigate.yaml: MCTL_RUN_TOKEN_MODE: observe → enforce.

In enforce (mctl-agents 1.90.0, orchestrator/run_token.py):

• the investigator exchanges its projected ServiceAccount token for a run token bound to this run's execution (agent issue-investigator, scope investigate, expiry no later than the Workflow's deadline) and connects MCP with it instead of the shared credential;
• mctl-api refuses anything outside the investigate scope (read tools, the run's own work item) with 403 and an agent_scope.denied audit row;
• if the exchange fails, the run fails; it never falls back to the shared credential;
• the token is revoked when the run exits.

Evidence from observe (since #2059, 2026-10-22)

• Two organic investigate runs (12:01Z, 17:21Z): agent_run_token.exchange and agent_run_token.revoke both succeeded each time; the first run was followed end to end and succeeded.
• mctl_agent_scope_decisions_total{mode="shadow",scope="investigate"}: 18 REST and 1 MCP decisions, all allow, 0 deny.

Not in this PR

The pod's own REST clients still use MCTL_TOKEN; moving them, the other agent surfaces and revoking the static credential are tracked in mctlhq/mctl-agents#752.

Rollback

Set the value back to observe (no image change needed).

Refs mctlhq/mctl-agents#737

🤖 Generated with Claude Code

[claude]

Claude finished @mashkovd's task in 36s —— View job

---

Review complete ✅

• Gather context (PR body, diff, CLAUDE.md)
• Review diff for correctness/security/operational safety
• Post verdict

Diff analyzed: git diff b9f3159410ba34b943bab722a6092532c61cf057...e0acb698e3a612f5ebd03ed1ef0f7f18cbb0733a — single-file change to cwft-mctl-agents-investigate.yaml: MCTL_RUN_TOKEN_MODE flipped from observe to enforce, plus an updated comment explaining the rationale (prior observe-mode evidence, pending follow-up in mctlhq/mctl-agents#752).

This is a trivial, single config-value change (env var) with no template/RBAC/resource logic touched, so per review policy it's approved without inline findings:

gh api repos/mctlhq/mctl-gitops/pulls/2078/reviews → APPROVED — "Trivial env var flip (observe → enforce) with accompanying comment update; evidence of successful exchanges in observe mode cited in PR description."

Rollback path (set back to observe) is documented in the PR description and requires no image change, consistent with how the MCTL_RUN_TOKEN_MODE gate is implemented elsewhere in this file.

[claude]

Trivial env var flip (observe → enforce) with accompanying comment update; evidence of successful exchanges in observe mode cited in PR description.

[github-actions]

Antigravity (agy) review — informational

Model: gemini-3.8-flash-high · commit e0acb69.

No significant issues found.