2026 Development Direction

[stephnangue]

Warden Development Direction Proposal (2026)

Warden shipped v0.1 in December 2025 and has been on a breadth-first cadence ever since: v0.10 (April 9) added 11 providers, v0.11 (April 20) added 7 more plus the agent role introspection API and the dualgateway framework, bringing the gateway surface to 32 providers. After this run of expansion, it's time to rebalance toward depth — to deliver on the database and object-storage promises the README has been making since v0.1, broaden where credentials can be sourced from, harden the platform for production use, and stabilize the foundation for a sustainable maintenance posture with documentation and reference materials that match the surface area.

At the high level, we seek contributions in the following areas:

1. "Coverage": to close the gateway-surface commitments still marked 🔜 in docs/providers.md — the database access tier and object-storage pre-signed URLs — to broaden credential sourcing beyond Vault/OpenBao with cloud-native secret-manager drivers, and to deepen existing providers (rotation drivers, transparent mode, request-body policy parsing) so breadth is matched by depth;
2. "Agent Experience": to make Warden a first-class destination for autonomous agents and MCP servers — beyond "just swap the base URL." Self-discovery so an agent can learn its own access, structured denial responses so an agent can self-correct without hand-coded fallbacks, native MCP exposure so an LLM can introspect Warden through the same protocol it uses for other tools, and recipes for the agent frameworks people actually deploy;
3. "Operator Experience": to enable easier and safer operation of Warden through observability instrumentation (tracing and metrics, push and pull), a real security CI baseline, Kubernetes-native deployment artifacts, completion of the sys/* lifecycle endpoints, and rate-limiting/quota controls;
4. "Scalability": to support larger deployments through performance benchmarks, published capacity targets, and CI regression gating;
5. "Sustainability": to ensure long-term viability by publishing an OpenAPI specification and consolidated policy reference, a reference architecture covering topology / sizing / failure modes, a documentation overhaul that matches the surface area, and an ecosystem (Helm, Terraform) around the existing PostgreSQL-backed core.

Even if not explicitly laid out below, we think features and contributions in these areas would be well-received and we encourage any and all original contributions. Issues tagged for one-shot cleanup work are good first-PR targets; sweep candidates already surfaced include cmd/server/server.go:323, core/seal.go:450, core/seal_access.go:49, core/namespace_store.go:317, and the CLI JSON-output stubs at cmd/namespaces/list.go:74 and cmd/namespaces/read.go:66.

If you're interested, feel free to reach out via the contributing guide.

Roadmap

1. The Agent Role Introspection API (GET /v1/sys/introspect/roles and per-backend equivalents), so an autonomous agent can discover the roles it may assume by presenting only its identity vehicle. Agent Experience. Landed in v0.11.0 (feat: add description field to JWT and cert roles #162, feat: add per-backend role introspection for JWT and cert #163, feat: add /v1/sys/introspect/roles aggregator across auth mounts #166).
2. The dualgateway framework, a shared base for providers that auto-detect between REST API proxying and S3-compatible object storage on a per-request basis. Sustainability. Landed in v0.11.0 (feat: add Scaleway provider with dual-mode gateway, SigV4 shared pack… #148, feat: add OVH provider with dual-mode gateway, dualgateway shared fra… #149).
3. Two-stage asynchronous credential rotation with prepare → persist → scheduled-activate, replacing the polling loops in the AWS and Azure drivers. Scalability. Landed in February 2026.
4. OpenBao internal-package extraction, eliminating dependence on five upstream packages with no API stability guarantees (helper/locking, helper/pgpkeys, helper/fairshare, helper/namespace, and physical/postgresql). Sustainability. Landed — see internal/locking, internal/pgpkeys, internal/fairshare, internal/namespace, and physical/postgresql. go.mod now only depends on openbao/sdk/v2 and openbao/api/v2.
5. Database access tier, completing the 🔜 commitments in docs/providers.md: finish AWS RDS / Aurora (MySQL + PostgreSQL with a rotation-capable driver), then GCP Cloud SQL, Azure SQL (Entra database auth — reuses the Azure OAuth2 path), AWS Redshift, and Snowflake. Reuses the access-backend pattern introduced in v0.6 at provider/rds/. Coverage.
6. Object-storage pre-signed URLs for AWS S3, GCP Cloud Storage, and Azure Blob Storage. Distinct from the existing dual-mode S3 proxying — Warden returns a URL bound to a single object, operation, and expiry. Likely a new "grant backend" provider type alongside streaming / dual-mode / access. Coverage.
7. Cloud-native secret-manager source drivers — AWS Secrets Manager, GCP Secret Manager, and Azure Key Vault (secrets, not just KMS-for-unseal). Today only hvault works as a universal source for api_key, gcp_access_token, and oauth_bearer_token (introduced v0.9.0); customers on cloud-native secret stores can't centralize there without also running Vault. Each driver follows the universal-source pattern: any provider consuming api_key / oauth_bearer_token accepts the new source type. HCP Vault is already covered by the existing hvault driver and just needs documentation. Optional stretch: SaaS-native managers (Doppler, Infisical, 1Password Connect) for customers who don't run cloud-provider secret stores. Coverage.
8. OpenTelemetry tracing across the request lifecycle (auth → policy → credential mint → upstream call → audit). OTel is already a transitive dependency in go.mod (recent dependabot bump deps(deps): bump go.opentelemetry.io/otel from 1.39.0 to 1.41.0 #169) but no .go file imports it. Highest-leverage observability item — every other operational concern (latency debugging, cross-service correlation) lights up at once. Operator Experience.
9. Metrics emission, pull and push. Today only seal encrypt/decrypt are instrumented (core/seal/seal.go); the rest is dark. Ship Prometheus pull (sys/metrics?format=prometheus, gated by policy or an unauthenticated_metrics_access listener toggle for unauthenticated scrapers) and an HCL telemetry { … } stanza for StatsD, DogStatsD, OTLP push (paired with item 8), and Prometheus remote-write. Instrument HTTP request lifecycle (per provider/role/namespace), auth, policy decisions and runtime-condition trips, credential rotation, upstream provider calls, PostgreSQL, the fairshare worker pool, the audit pipeline, and Go runtime. Pairs with item 13 (quotas), which need metrics to surface when limits are biting. Operator Experience.
10. Security CI baseline — add gosec, govulncheck, and CodeQL to .github/workflows/; generate an SBOM in the release workflow; sign release artifacts with Sigstore/cosign. Pair with a real SECURITY.md covering supported versions, disclosure process, and threat model — currently the file is just a single heading. Operator Experience.
11. System backend endpoint completion. Warden today exposes a fraction of the Vault/OpenBao sys/* surface — health, ready, leader, step-down, seal-status, init, plus the per-resource logical endpoints (audit, auth, cred, namespaces, providers, policies). Missing for production operation, in priority order: lifecycle (sys/seal, sys/unseal, sys/rekey/*, sys/rotate, sys/generate-root/*), lease management (sys/leases/* — internal rotation exists, no user-facing API today), operator-side policy introspection (sys/capabilities, sys/capabilities-accessor), operability (sys/loggers, sys/monitor, sys/host-info, sys/version-history, sys/config/state/sanitized), and recovery/tooling (sys/raw/* gated tightly, sys/tools/*). Agent-facing sys/*-self endpoints are tracked in item 19. Wrapping (sys/wrapping/*), control groups, and replication-style endpoints are not on this list — they don't fit Warden's model. Operator Experience.
12. Helm chart for Kubernetes deployment, with Deployment/StatefulSet, Service, Ingress, cert-manager hooks for auto-TLS, and ConfigMap/Secret for HCL config. The first deployment a serious user attempts is Kubernetes; today only docker-compose is published. Operator Experience.
13. Quotas and rate limits, exposed as sys/quotas/rate-limit/* and sys/quotas/token-count/* — per-role, per-namespace, and per-IP request and credential-mint quotas with Retry-After semantics. Scaffolding for the underlying counter already exists at core/request_handler.go:160 ("allowed so we can decrement the use count (to be implemented in the future)"). Operator Experience.
14. Cloud-KMS auto-unseal end-to-end coverage. The go-kms-wrapping integrations exist on paper for AWS KMS, GCP KMS, Azure Key Vault, OCI KMS, PKCS#11, and KMIP, but no e2e confirms the path is wired and tested. Add an e2e for at least one cloud KMS auto-unseal. Operator Experience.
15. OpenAPI specification for the Warden HTTP API, exposed at sys/internal/specs/openapi per the Vault/OpenBao convention. Unlocks SDK generation, Postman collections, and API gateway integrations. Pair with a consolidated docs/policy-reference.md covering the full CBP grammar, runtime conditions (added v0.3), and capability semantics — currently scattered across 32 provider READMEs. Sustainability.
16. Reference architecture document. The "where does Warden actually sit, at what scale, with what failure modes" guide that today nobody can hand to a customer. Cover topology and identity-flow diagrams, sizing guidance, network placement, security boundaries, common deployment patterns (Kubernetes, CI/CD with OIDC, multi-cluster), and failure-mode runbooks. Vault's Reference Architecture is the precedent. Sustainability.
17. Documentation overhaul. The surface area has outgrown the docs. Beyond OpenAPI (item 15) and policy reference (item 15 + non-code item 2), the gaps are: a glossary of Warden-specific terms (source, spec, role, mint method, capability, transparent mode, dual-mode, access backend, grant backend); concept docs explaining capability-based policy versus traditional ACLs and the two-stage async rotation model; per-credential-driver reference (credential/drivers/, not all have docs); operator runbooks for common failure modes (re-seal recovery, lost-quorum, slow upstream, audit overflow); version-migration guides for the schema-ish changes implied by CHANGELOG churn (v0.6 token-type purge, v0.9 mint-method renames). Sustainability.
18. VerifySource interface to validate source credentials at source-create time via live API calls, paralleling the existing SpecVerifier. Lets drivers go beyond format validation without adding startup latency or boot-failure risk. Sustainability.
19. Client SDKs — Go (in-repo), then Python and TypeScript. The "no Warden SDK, just swap the base URL" pitch holds for streaming providers, but agents that consume sys/introspect/roles, manage role discovery, or interact with access-backend grants will want a typed client. Python first — that's where most agent code lives. Agent Experience.
20. Self-introspection completeness — sys/lookup-self (return current token's TTL, role, policies, namespace, source identity vehicle), sys/capabilities-self (what can I do at this path?), and sys/introspect/credentials (which credential specs can I mint?). Together with the already-landed sys/introspect/roles, this gives an agent a complete self-model in three calls — the difference between an agent that can plan and one that can only react. Agent Experience.
21. Structured policy-denial responses. When a request is denied today, the agent gets a generic 403. Return JSON instead with policy_name, missing_capability, failed_condition (which runtime condition tripped — source_ip / time_window / day_of_week), and an optional suggested_role if a sibling role the caller is eligible for would have permitted the call. Lets agents self-correct without the developer hand-coding fallback ladders. Pair with response headers (X-Warden-Policy-Decision, X-Warden-Credential-Type) so streaming clients see the same context without parsing the body. Agent Experience.
22. MCP server for Warden's introspection surface. Ship an MCP server that exposes role discovery, credential listing, capability queries, and (optionally) lease lookup as MCP tools. Lets an LLM-driven agent reason about its own access through the same protocol it uses to call other tools — and closes the README's MCP framing with a concrete artifact rather than just a use case. Agent Experience.
23. Agent-framework recipes — quickstart guides in docs/recipes/ for Goose, LangChain, LlamaIndex, OpenAI Agents SDK, AutoGen, and Claude Agent SDK. Each shows the smallest diff to point that framework's HTTP client at Warden, configure the JWT identity vehicle, and consume sys/introspect/roles for role discovery. Companion to the existing Vault policy hygiene tutorial but framework-pattern-focused, not workflow-focused. Agent Experience.
24. Kubernetes operator with CRDs (AuthMethod, CredentialSource, CredentialSpec, ProviderMount, Policy) so Warden becomes gitops-native. Likely a separate repo so Warden core doesn't take a controller-runtime dep. Follows the Helm chart, not the other way round. Operator Experience.
25. Additional auth methods — Kubernetes ServiceAccount (TokenReview), AWS IAM (sts:GetCallerIdentity verification), GCP IAM (instance-identity tokens). Each unlocks workloads that already have a native identity in their environment without requiring a separate JWT issuer or PKI. Coverage.
26. Performance harness — *_bench_test.go files (count is currently zero), a documented load-test rig (k6 or vegeta against an e2e cluster), published capacity targets (req/s and p99 latency at N concurrent agents), and CI regression gating once baselines exist. Scalability.
27. Provider depth audit, run quarterly. For each provider, score: rotation driver? transparent mode? request-body policy parsing? e2e coverage? Then ratchet up the floor. The breadth-first phase added many providers without all four; for example, provider/atlassian/README.md:547 explicitly defers the source driver to a future release. Coverage.
28. AWS S3 variants — Directory Buckets (session-based auth, CreateSession API), Table Buckets (s3tables.* signing service), Vector Buckets (s3vectors.*). Documented as unimplemented in provider/aws/README.md; narrower audience than the database tier but worth tracking as the AWS S3 ecosystem fragments. Coverage.

Non-code changes

We'd also like to encourage non-technical, community-led improvements in the following areas:

1. More end-to-end tutorials in docs/tutorials/, in the style of the Vault policy hygiene tutorial — a sibling tutorial is already flagged as "coming soon" at docs/tutorials/vault-policy-hygiene/README.md:1032.
2. A capability-based-policy reference, consolidating the policy grammar and runtime conditions from the 32 per-provider READMEs into one canonical document.
3. A deployment guide for Kubernetes, walking through the Helm chart once it lands, including JWT issuer setup, mTLS with cert-manager, and integration with workload identity.
4. Architecture documentation explaining the provider framework choice tree (httpproxy vs dualgateway vs access backend vs grant backend) so new contributors can pick the right base when adding a provider.

Reaching out

If anyone has questions about getting started or collaborating, file an issue or open a discussion on GitHub.

---

Note: this is the first formal Development Direction proposal for Warden. The next update will be in January 2027 to align with calendar years going forward.