theAuth for AI Agents: Identity and Scoped Permissions

Описание и применение

В статье описывается, как заменить общий ключ API, используемый несколькими AI‑агентами, на индивидуальные токены с ограниченными правами, обеспечивая аудит и возможность отзыва каждого токена отдельно.

Задача

A shared human API key used by multiple AI agents and scripts caused broad permissions, difficulty revoking individual agents, and a misleading audit trail.

Результат

Agents operate with minimal blast radius, can be revoked individually, and actions are auditable per agent.

Рабочий процесс

• Install Node 20+, TypeScript, and theauth package
• Create a SQLite database instance with agents enabled
• Seed an owner user row
• Create one agent per job using theauth.agent.create
• Call authorize() before each agent action
• Add constraints such as rate limits and argument patterns
• Check tokens in middleware to return 401/403
• Delegate to sub-agents with narrower scopes
• Read audit trail, rotate, and revoke tokens

Доказательства

A shared human key has three problems, and they stack.

Источник

Each agent holds a token that maps to one row, one owner, and one permission list.

Источник

Call authorize() before every action

Источник