Identity & authority

Authority starts with a Principal

A limited, explicit grant

A Delegation Grant should identify the Principal, the receiving agent, the allowed actions and resources, the expiry, and any approval or budget requirements. Its scope must be a subset of the Principal’s own authority.

Download authorize.pyand run it with Python 3.11 or later. It creates a two-hour grant, allows a scoped log search, and rejects a deployment rollback.

"""Authorization checks for a trusted, already authenticated runtime context."""
from dataclasses import dataclass
from datetime import datetime, timedelta, timezone
from decimal import Decimal


@dataclass(frozen=True)
class Grant:
    principal: str
    agent: str
    resources: frozenset[str]
    actions: frozenset[str]
    expires_at: datetime
    revoked: bool = False


def authorize(grant: Grant, *, principal: str, agent: str, resource: str,
              action: str, now: datetime, spent: Decimal,
              budget: Decimal, tool_calls: int) -> None:
    """Raise on denial. The caller supplies verified identity and usage."""
    checks = (
        not grant.revoked,
        now < grant.expires_at,
        principal == grant.principal,
        agent == grant.agent,
        resource in grant.resources,
        action in grant.actions,
        Decimal("0") <= spent < budget,
        0 <= tool_calls < 100,
    )
    if not all(checks):
        raise PermissionError("Action is outside the current authority or limits")


if __name__ == "__main__":
    now = datetime.now(timezone.utc)
    grant = Grant(
        principal="alice", agent="incident-investigator",
        resources=frozenset({"service-a"}),
        actions=frozenset({"logs.search", "deployments.read"}),
        expires_at=now + timedelta(hours=2),
    )
    context = dict(principal="alice", agent="incident-investigator",
                   resource="service-a", action="logs.search", now=now,
                   spent=Decimal("0.50"), budget=Decimal("5.00"), tool_calls=3)
    authorize(grant, **context)
    print("ALLOW: logs.search on service-a")
    try:
        authorize(grant, **{**context, "action": "deployments.rollback"})
    except PermissionError:
        print("DENY: deployments.rollback on service-a")
    else:
        raise AssertionError("An unauthorized action was allowed")

python3 authorize.py
# ALLOW: logs.search on service-a
# DENY: deployments.rollback on service-a

Call this check inside the trusted runtime before dispatching a tool. Supply the authenticated Principal, current grant record, and server-maintained usage; never take them from model-generated tool arguments. Authentication, grant storage, and atomic budget reservations remain the runtime’s responsibility.

Grant issuance must verify that Alice can delegate these actions. Model output cannot create or widen a grant. Renewing or modifying access requires authorization again.

Execution identity is evaluated per session

The Execution Identity is the effective authorization context, not simply a user name in a prompt. Combine Principal identity, the agent, the current grant, resource restrictions, and policy. Check authorization again before each tool invocation, including after retries or interruptions.

Stopping a task, terminating a session, and revoking a grant are distinct controls. Revocation must prevent future calls, including calls from a resumed session. A revoked grant must not become usable through cached credentials.

Sharing is a separate decision

A person who may read a task result is not automatically allowed to continue a session or use its connections. Read-only sharing, forking, and collaboration need explicit permissions. A fork should receive a fresh authorization evaluation and should not copy usable secrets.

Delegation across agents

If onward delegation is allowed, scope it explicitly. A receiving agent cannot obtain more authority than the grant permits. Record the delegation chain so a reviewer can connect an action to the Principal who authorized it.