AI agents hold tokens, call APIs, spend money, and talk to other agents — but they authenticate like it's 2015. Agent Identity Kit makes agents first-class identities in your enterprise directory, with delegation you can prove, credentials that expire when the task does, and receipts an auditor can verify without trusting your servers.
$ cargo run -p aik-server
click a step to jump to it · click the terminal to fast-forward the current one
Seven commands, one agent: a sponsor vouches for it, a scoped grant delegates to it, a token is minted just for the task, the gateway lets the in-scope call through and injects the credential itself — the agent never touches it — then hard-denies the out-of-scope one before it reaches anything upstream. Revoke, and the exact same command dies everywhere, in seconds.
Every agent is registered with a human or team sponsor before it can obtain a single credential. Sponsor leaves? Their agents' access dies through the same offboarding flow you already run for people. Unregistered agents get nothing — fail-closed by construction, not by configuration.
Signed delegation grants built on OAuth 2.1 Token Exchange (RFC 8693) and Rich Authorization Requests (RFC 9396). The token at hop five still carries the original human principal. Ask "who authorized this?" and get a cryptographic answer, not a log-grep.
The broker mints per-task tokens just-in-time — sender-constrained with DPoP (RFC 9449), TTL'd to minutes, dead when the task completes. Credential accumulation isn't monitored; it's structurally impossible. A leaked token is a sender-bound, expired token: useless.
Identity enforcement at the transport layer. Filters tools/list by
entitlement — an agent that cannot see a destructive tool cannot be tricked into
calling it. Injects task-scoped credentials upstream; agents never see the real
ones. Zero agent code changes.
Every registration, delegation, mint, and gateway decision produces a signed, hash-chained receipt — verifiable by an external auditor without trusting your runtime. Parameters stored as salted hashes, so the audit trail can never become the leak.
Revocation rides Shared Signals (CAEP). Suspend an agent, revoke a delegation, or offboard a sponsor — every broker and gateway honors it within seconds. Killing the identity kills every downstream credential, including in processes you don't run.
your IdP (Okta · Auth0 · any OIDC)
│ RS256 org token — the human, verified
▼
┌─────────────────────────── agent identity kit ──────────────────────────┐
│ registry ──► delegation ──► broker ──► mcp gateway ──► receipts │
│ sponsored signed grant JIT DPoP entitlements signed, │
│ fail-closed hop0=human tokens + budgets chained │
│ │
│ ◄──────────────── CAEP revocation fabric — seconds to kill ───────────► │
└──────────────────────────────────────────────────────────────────────────┘
│ task-scoped, sender-bound token
▼
tools & APIs (MCP servers · SaaS · your services)