Introduction

AgentBox gives AI agents an identity of their own — delegated from a developer, governed by the enterprise, and never backed by a credential the agent can read.

The problem

Every enterprise already has agents at work, and almost all of them authenticate with a developer's personal access token or API key, pasted into a local file. That means:

The agent is the developer. There's no way to tell them apart in an audit log, and no way to give the agent less than the developer has.
Secrets sit where the agent can read them. Package scripts, generated code, and prompt-injected instructions can all read .env.
Revocation means rotating a human's credential and finding every place it was copied.

The delegation principle

An agent's authority is at most the developer's, and usually less.

Never more. Entitlements resolve from the issuing human's own directory entry, GitHub login, and assigned tickets. There is no way to grant an agent a team its developer isn't on.
Usually less. The identity carries a work mode (readonly, build, operate) and a single task; rules scope it further to a repository, ref pattern, and operation.
Always separate. The agent has its own identity in every audit record, its own approvals, and its own revocation. Cutting it off never touches the developer's credentials.

What AgentBox does

Issues an identity. A developer mints a signed Ed25519 assertion on a trusted host: human, agent, team, work mode, task, expiry. It's bound to one workspace and revocable.
Enforces it with your existing tooling. Rules can require directory groups, GitHub teams, Backstage ownership, a work mode, or a live, assigned Jira ticket — the same signals that already govern the developer.
Brokers every privileged call. The agent runs ordinary git, agentgate pr, or the Anthropic SDK. A trusted daemon holds the credentials, decides, asks humans when needed, and forwards with a token scoped to one resource and one operation.
Proves it. Every decision carries the verified identity and entitlement envelope in a hash-chained audit log, forwarded off-host, with SIEM detections.

Developer ── issues identity ──> Agent runtime ── request + identity ──> agentd ──> GitHub / model APIs
                                                                            │
                                                     entitlements · policy · approvals · audit
                                                                            │
                                                          AD/Entra · GitHub teams · Backstage · Jira

Prototype

AgentBox is an early implementation, not yet a production authorization service. GitHub is the first brokered provider; see the roadmap for GitLab, AWS, Azure, Kubernetes, ServiceNow, and PagerDuty. Read the security model before handling untrusted workloads.

What's in the box

Component	Role
`agentd`	Broker: identity verification, entitlements, policy, approvals, audit
`issue-runtime.js`	Mints agent identities on the trusted host
`agentgate` CLI	Workspace commands for PRs, CI, and diagnostics
`approval-web`	Browser approvals behind OIDC (oauth2-proxy)
`egress-proxy`	Allowlisting CONNECT proxy for package registries
`model-gateway`	Injects model API keys outside the workspace
`control-plane`	Signed policy bundles and fleet inventory

Next steps

Quickstart — run the credential-free demo in about a minute.
Runtime identity — issue, renew, and revoke agent identities.
Entitlements — gate rules on groups, teams, ownership, and tickets.
Connect GitHub — broker a real repository through a GitHub App.