Architecture · Published 26 August 2026
Scoped credentials for AI agents: separating identity from authority
Why a valid agent identity is only the start, and how expiring mandates constrain action, resource, budget, and consent.
Identity is not permission
An agent passport can prove which agent and device produced a request. It cannot by itself say whether that agent may send an email, invoke a tool, spend a budget, or act for a person. Ujex represents those decisions as separate, expiring mandates.
This separation keeps authentication from silently becoming blanket authorization. A verifier checks subject, audience, resource, action, budget, time, delegation, and approval state before issuing a protected capability.
Keep secrets outside the model
The agent should name an allowed tool and structured input, not receive the provider credential. The control plane retrieves and injects the secret only after policy evaluation. Logs and evidence store references and outcomes, never the raw secret.
Prompt injection can still influence requested intent, but it cannot manufacture a scope the policy engine did not issue.
Consent is a state transition
A risky operation moves into a pending approval state with a stable digest of the proposed action. Human approval signs that exact proposal; changing recipient, amount, tool input, or expiry invalidates the approval.
Retries use the same idempotency identity so one approval cannot become multiple side effects.
Evidence must travel
Hash-linked events are packaged with manifests, anchors, signer metadata, and the minimum verification material. Offline verification lets an auditor test integrity without granting access to the live tenant.
Portable evidence does not mean public evidence. Export remains scoped to the owner and its authorized auditors.
Production checklist
- Verify Scoped authority against the deployed environment, not a screenshot.
- Verify Server-side secrets against the deployed environment, not a screenshot.
- Verify Fail-closed verification against the deployed environment, not a screenshot.
- Verify Portable evidence against the deployed environment, not a screenshot.