Product / Tether / Agent Access
Give every agent an identity. Bound what it can do.
Connect independently built agents to enterprise tools with registered identity, short-lived authority, deployment controls, and immediate revocation.
01 / Identify
A stable identity for every agent deployment.
Register the agent independently from the application that runs it. Bind its proof key, approved version, deployment, and lifecycle into one authority record.
- Separate agent identity from OAuth client identity
- Bind approved versions and environments to a proof key
- Keep ownership as governance metadata, not delegated authority
Authority subjectagent://finance/reviewer
- Source
- Proof key verified
- Version
- v14 / Approved
- Deployment
- prod-us / Bound
- Owner
- Finance Platform
02 / Bound
Authority that is narrow by construction.
Exchange an agent's source identity for short-lived, audience-bound authority. Every token is constrained to the agent, deployment, task, and protected resource.
- Proof-bound tokens resist replay outside the approved deployment
- Task scope can narrow access but never widen enterprise policy
- Provider credentials never enter the agent runtime
Authority subjectgithub.issue.read
- Principal
- agent://finance/reviewer
- Audience
- mcp.axec.dev
- Proof
- DPoP / Key matched
- Expires
- 00:04:42
03 / Revoke
End authority at the source.
Disable an agent, version, deployment, session, or key from one lifecycle boundary. Current identity and policy state is checked again before controlled actions proceed.
- Terminate active sessions after material lifecycle changes
- Block credential release immediately after revocation
- Fail closed when identity or policy state cannot be verified
Authority subjectdeployment.prod-us
- Agent
- Active
- Version
- v14 / Disabled
- Sessions
- Terminated
- Credentials
- Release blocked