IBAC demo -- MCP tools behind an intent gate and an OpenFGA gate

A teaching demo for the DevOpsDays 2026 talk "ReBAC with OpenFGA". An MCP server exposes two tools, list_team and list_salaries (the slide deck writes them as list-team / list-salaries; same things, fake data). Every call has to get past two gates:

  request (x-api-key, x-user-intent)
    -> identity extraction        naive, on purpose
    -> Gate 1  IntentGate         does this call serve what the human asked for?
    -> Gate 2  FgaGate            does a tuple grant can_use on this tool?
    -> tool handler

Gate 1 is semantic and probabilistic, Gate 2 deterministic. The order matters: an agent that legitimately holds a permission can still be stopped at Gate 1 when something talks it into using that permission off-task.

Run it

Pre-pull once, on a network that likes you:

docker pull openfga/openfga python:3.12-slim

Then:

make up        # build the image, start OpenFGA
make init      # create the store, start the server
make demo      # the acceptance table
make attack    # the money shot

make help lists the rest. Everything runs in containers -- there is no second way to run this.

Demo it with a real agent

opencode.json points opencode at the server as an MCP client, once per persona -- each entry pins a different x-api-key and x-user-intent, so the agent picks a caller by picking a toolset:

entry	identity	stated intent
ceo	ceo-bot-key	show me the team roster
ceo-payroll	ceo-bot-key	show me executive salaries
stranger	random-stranger	show me the team roster
magma	magma-grunt-01	show me the team roster and the salaries
aqua	archie	salary review for finance

opencode run "use the ceo tools to list the team"          # allowed
opencode run "use the ceo tools to list their salaries"    # blocked at gate 1

That config also denies the agent bash and edit, which is not cosmetic. Run it without those denials and a blocked agent will rewrite x-user-intent in the config and call the server with curl instead -- observed, not hypothetical. The intent header is self-asserted, exactly like the API key. Gate 1 defends against an agent that is manipulated; it does not defend against an agent that is itself adversarial.

The storyline

stage	command	what changes	the beat in the talk
V0	make init	model_v0 + 2 tuples	"We're done adding code." One agent, two tools, done.
V1	make magma	model_v1 + 13 tuples (1 userset + 12 members)	Magma shows up with twelve agents. One tuple grants the whole org list_team, twelve put the grunts in the org.
V2	make aqua	3 tuples, model untouched	Aqua shows up. No schema change needed -- the model already said what it needed to say.

The authorization model is written exactly twice in the whole story and never again. OpenFGA keeps both versions in the store.

models/ holds each version twice: .fga is the DSL the slides show, .json is what the API accepts and what setup_fga.py sends. They are equivalent -- fga model transform --file models/model_v1.fga reproduces the JSON.

make explain shows the difference between a model and a tuple on a throwaway store: the same userset tuple rejected under model_v0 and accepted under model_v1, and can_use answering checks while never being stored.

V1 writes zero tuples for list_salaries. Nobody wrote a deny rule, and the twelve Magma agents still cannot read salaries. That is default-deny doing the work.

Scenario 7 is the point of the demo. ceo-bot-key genuinely holds can_use on list_salaries -- scenario 2 proves it. Ask it for the team roster, then make it reach for salaries anyway:

$ make attack
BLOCKED at gate 1  (intent)
403 intent mismatch: tool list_salaries does not serve stated intent: 'show me the team roster'

Permissions alone would have allowed that call. Intent is what caught it.

Gate 1's judge is a keyword map by default, so the demo has no network dependency. INTENT_BACKEND=anthropic|ollama swaps in a real model, and both fail closed. See .env.example.

Verified against fastmcp 3.4.5, openfga-sdk 0.10.4, OpenFGA 1.18.1, Python 3.12, Docker 29.1.3 / Compose 2.40.3 on Ubuntu 24.04.