Do not open a public issue for a security problem. Write to jaime.jimenez@ericsson.com with a description of the issue and the steps to reproduce it. You will get an acknowledgement within 5 working days.

The reference implementation in src/agent_directory/ is in scope. The demo under demo/ is a demonstration and has no hardening; problems there are ordinary bugs and can go in the public issue tracker.

Documented design decisions:

• Write access is bound to an opaque Bearer token. Anyone holding the token can modify or delete the registration. The draft calls for WIMSE workload identity tokens; see the README.
• The directory never sets the identity field. A client-supplied value is rejected with 400, and the field stays empty until a WIMSE token can be verified.
• There is no rate limiting. Run the service behind a reverse proxy that provides it.
• Registrations are public. Anything you register can be read by any client that can reach the directory.