Introduction

AgentBox is identity and access for AI agents. Each agent runtime gets a signed, revocable identity delegated from a developer, governed by the enterprise's existing machinery, and never backed by a credential the agent can read.

The problem

Every enterprise already has agents at work, and almost all of them authenticate with a developer's personal access token or API key, pasted into a local file. That means:

The agent is the developer. There's no way to tell them apart in an audit log, and no way to give the agent less than the developer has.
Secrets sit where the agent can read them. Package scripts, generated code, and prompt-injected instructions can all read .env.
Revocation means rotating a human's credential and finding every place it was copied.

The delegation principle

An agent's authority is at most the developer's, and usually less.

Never more. Entitlements resolve from the issuing human's own directory groups, GitHub login, and assigned tickets. The issuing service refuses a team the developer doesn't hold, and the broker can re-check it on every request.
Usually less. The identity carries a work mode (readonly, build, operate) and a single task; rules scope it further to a repository, ref pattern, and operation.
Always separate. The agent has its own identity in every audit record, its own approvals, and its own revocation. Cutting it off never touches the developer's credentials.

What it governs

Access	How AgentBox handles it	Status
GitHub over Git (clone, fetch, push, LFS)	The workspace's Git talks to the broker; the broker mints short-lived GitHub App tokens, applies default-deny policy per repository, ref, and operation, and asks for approval when a rule says so	Shipped
Pull requests and CI	`agentgate pr` and `agentgate ci` call the broker, never GitHub; merges always need a human	Shipped
Model APIs	A gateway on the workspace network injects the provider key, allowlists paths, and enforces budgets	Shipped
Everything else on the network	An allowlisting CONNECT proxy is the workspace's only route out; GitHub direct is always denied	Shipped
Who the developer is and what they're working on	Directory exports, GitHub teams, Okta, Entra ID, Jira, and ServiceNow compile into an envelope rules can require	Shipped
GitLab over Git, merge requests, pipelines	The same broker paths and CLI, with an OAuth refresh token the broker rotates in place; no LFS yet	Shipped
Vendor-hosted agents (Copilot coding agent, Cursor background agents)	Webhooks plus a required check run: policy and human approval gate their merges, pushes are audited; see Hosted agents	Shipped
AWS, Azure, Kubernetes, internal APIs	Provider-native short-lived credentials behind the same identity	Roadmap

No MCP or agent-specific integration is required. Cursor, Copilot, Claude Code, Codex, and whatever comes next work unmodified, because the boundary is Git and the network, not the agent.

Developer ── issues signed identity ──> Agent workspace ── Git HTTP + identity ──> agentd ──> GitHub
                                             │                                       │
                                model gateway · egress proxy      entitlements · policy · approvals · audit
                                                                                     │
                                            AD/Entra · Okta · GitHub teams · Jira · ServiceNow ── approvals

AgentBox is open source under the Apache 2.0 license, open core: the broker, workspace, policy engine, entitlement sources, issuer, gateway, proxy, and the single-fleet control plane in the repository are and will stay open. NoKeys sells the multi-fleet control plane (cross-broker approvals and inventory, directory-driven revocation, analytics) and support.

Names

The broker daemon is agentd, the workspace command is agentgate, and settings are AGENTGATE_*. Those names predate the product name and are kept for compatibility.

Status

Pilot-ready for a platform team that reads the security model, which says what AgentBox does and does not protect against. It has not had an external security review, and the control plane is still partial. The roadmap lists what is shipped versus planned.

What's in the box

Component	Role
`agentd`	Broker: identity verification, entitlements, policy, approvals, audit; signs with a key file or AWS KMS
`issuer-web`	Developers sign in through your identity provider and mint identities for their own workspaces; dashboard with revoke
`issue-runtime.js`	Mints identities from the command line, for automation
`agentgate` CLI	Workspace commands: `doctor`, `fingerprint`, `renew`, `pr`, `ci`
`approval-web`	Browser approvals behind OIDC (oauth2-proxy)
`egress-proxy`	Allowlisting CONNECT proxy for registries and, optionally, IDE servers
`model-gateway`	Injects model API keys outside the workspace
`audit-forwarder`	Ships the hash-chained audit log to your SIEM
`control-plane`	Signed policy bundles, fleet inventory, central approvals
`hosted-agents`	Governs vendor-hosted agents through webhooks and a required check run

compose.yaml runs the first, plus the workspace, proxy, and gateway, on a developer's machine. compose.enterprise.yaml adds the issuer, approvals, forwarder, and oauth2-proxy where reviewers and the audit pipeline live.

Next steps

Quickstart — the five-minute start, or the credential-free demo.
Onboarding a company — what the platform team does once, what a developer does per machine.
Issuing identities — the login-backed issuer and dashboard.
Entitlements — gate rules on groups, teams, ownership, and tickets.