Give your agent
an identity.
Not your keys.

AgentBox is identity and access for AI agents. Each runtime gets a signed, revocable identity delegated from a developer, bounded by what that developer is allowed to do — and usually less. Governed by the same groups, teams, and change tickets. Credentials never enter the workspace.

Start the demo How it works

Open source · zero npm dependencies · no MCP required

runtime assertion · rt-42ed25519 · verified

human: [email protected]
agent: claude-code
team: payments
mode: build
task: jira:PAY-12
exp: 8h · revocable

decisions

Works with any agent, unmodified

Claude Code
Codex
Cursor
Copilot
Aider
your own

The gap

Every enterprise already runs agents on personal access tokens.

Developers hand their agents a PAT, an API key, a cloud profile — pasted into a local file, because that's the only way the agent can work. The agent is now the developer, with no scope, no separate audit trail, and no off switch.

Enterprises solved this for humans years ago: directory groups, team ownership, change tickets, approvals. AgentBox brings that same machinery to agents — and keeps the secrets out of their reach entirely.

Agents authenticate as you: A PAT in .env or ~/.netrc makes the agent indistinguishable from the developer. The audit log says you did it.
Secrets live in local files: Every package script, generated snippet, and prompt-injected instruction can read the same files the agent reads.
Scope is all-or-nothing: A developer's token reaches every repo, branch, and API the developer can. The agent inherits all of it.
Revocation means rotation: Cutting off one agent means rotating a human's credential — and finding every place it was pasted.

The delegation principle

At most the developer. Usually less.

An agent’s authority is a subset of the human who issued it. Entitlements resolve from that person’s groups, teams, and tickets, so an agent can never be granted something its developer doesn’t have. Then the identity narrows it further.

Never more: Team membership comes from the developer's directory entry and GitHub login. A Jira elevation counts only if the ticket is assigned to that developer.
Usually less: Work mode (readonly · build · operate), a single task, and rules scoped to repository, ref, and operation cut the grant down to the job at hand.
Always separate: Its own identity in every audit record, its own approvals, and its own revocation — without touching the developer's credentials.

What [email protected] can do

teams: payments, platform · groups: engineering · owns: acme/payments, acme/billing · main via 2 reviewers

Agent rt-42 · claude-code

mode build · task PAY-12

✓push acme/payments refs/heads/agent/*
◷push acme/payments main — approval, 2 oidc
✕push acme/billing — not in this task
✕delete any ref · push tags
✕pr merge without a human

The inner box can never grow past the outer one. Revoking the agent leaves the developer untouched.

How it works

Issue an identity. Enforce it with the tools you already trust.

Developer
Issues a signed identity from the trusted host
Agent runtime
Presents it on every request — untrusted
AgentBox broker
Identity + entitlements + policy + approvals; holds every credential
Entitlement sources
AD/Entra, GitHub teams, Backstage, Jira
Providers
GitHub and model APIs today; GitLab, AWS, Azure, K8s on the roadmap

Issue

A developer mints an Ed25519 assertion on a trusted host: human, agent, team, mode, task, expiry. It's bound to one workspace token.

Present

The agent sends it with every request. Nothing else changes — Git, the Anthropic SDK, and CLIs work unmodified.

Enforce

The broker compiles a capability envelope from your directory, teams, catalog, and tickets, then decides: allow, deny, or ask a human.

Prove

Every decision, with the verified identity and envelope, lands in a hash-chained audit log your SIEM can consume.

Designed for AI-native developers

One command to delegate. One file to govern.

Issue an identity to your agent the way your org would issue one to you. Write the rules once, in JSON, with requires clauses that read from the systems your security team already owns.

Identity bound to a workspace, expiring in hours
Rules gated on teams, groups, ownership, mode, and ticket
Fail-safe: source outages never widen access
Hot reload; a policy change supersedes open approvals

Read the identity guide ›

trusted host

# On the trusted host: mint an identity for this agent runtime.
# The issuer's private key never touches the workspace.
$ node scripts/issue-runtime.js --key issuer.pem --kid k1 \
    --client-token-file ~/.agentgate-client-token \
    --audience agentgate:acme \
    --runtime-id rt-42 \
    --human [email protected] --agent claude-code \
    --team payments --mode build \
    --task jira:PAY-12 --ttl 28800 \
    --out ~/.agentgate-runtime-assertion

# Revoke it before expiry, by jti or by runtime:
$ cat revoked.json
{ "jtis": [], "runtimeIds": ["rt-42"] }

Integrations

Plugs into what governs your developers today.

Entitlement sources feed the decision. Providers are what the agent is allowed to reach. Both are adapters — GitHub is first because that's where agents do the most damage.

See the roadmap ›

Entitlement sources

AD / Entra groupsAvailable
Backstage ownershipAvailable
GitHub teamsAvailable
Jira work itemsAvailable
ServiceNow changeRoadmap
PagerDuty incidentsRoadmap

Providers

GitHub — Git, PRs, CI, LFSAvailable
Anthropic model APIAvailable
GitLabRoadmap
AWS STS / workload identityRoadmap
Azure workload identityRoadmap
Kubernetes impersonationRoadmap

Security

Built by assuming the agent is hostile.

The agent, its commands, repository contents, package scripts, prompts, and issue text are all untrusted. We publish the threat model — including what AgentBox does not protect against.

cosign-signed imagesSPDX SBOMSLSA provenanceTrivy-gated releasesFuzzed protocol parser

Read the security model ›

No credential in the workspace: GitHub App keys, model API keys, and Jira tokens live only in the broker — or in a KMS behind a signing command.
Fail closed, everywhere: Unknown actions, malformed protocol, audit write failures, expired policy, and entitlement source outages all deny.
Never more than the developer: Entitlements resolve from the issuing human's own groups, teams, and tickets. An outage can't widen them: allow rules need proof, deny and approval rules apply by default.
Approvals you can't replay: A grant covers the exact refs, object IDs, identity jti, and policy digest. Consumed once, durably, before forwarding.

Give your agent
an identity.
Not your keys.

Every enterprise already runs agents on personal access tokens.

At most the developer. Usually less.

Issue an identity. Enforce it with the tools you already trust.

Issue

Present

Enforce

Prove

One command to delegate. One file to govern.

Identity, authorization, and the enforcement to back it up.

Delegated identity

Enterprise entitlements

Task elevation

Human approvals

Brokered providers

Model API gateway

Scanning & egress

Tamper-evident audit

Plugs into what governs your developers today.

Built by assuming the agent is hostile.

Take the PAT out of your agent’s .env today.

Give your agentan identity.Not your keys.

Every enterprise already runs agents on personal access tokens.

At most the developer. Usually less.

Issue an identity. Enforce it with the tools you already trust.

Issue

Present

Enforce

Prove

One command to delegate. One file to govern.

Identity, authorization, and the enforcement to back it up.

Delegated identity

Enterprise entitlements

Task elevation

Human approvals

Brokered providers

Model API gateway

Scanning & egress

Tamper-evident audit

Plugs into what governs your developers today.

Built by assuming the agent is hostile.

Take the PAT out of your agent’s .env today.

Give your agent
an identity.
Not your keys.