Agent capability tokens say what an agent can do — not just who it is
Identity proves who the agent is. Capability proves authority. For autonomous agents, the token should encode routes, tools, budgets, expiry, delegation limits, and revocation checks before access is granted.
Credentials have to carry economic policy
Human access systems assume stable users, managed devices, predictable sessions, and human-scale request rates. Agent systems are different: credentials can be copied into tools, delegated to sub-agents, retried in loops, and used faster than a billing alert can fire.
The safe model is not a single permanent secret. It is a capability, checked before the request goes through, that answers: what can this agent do, on which route, for how long, with what budget, and can it still be revoked right now?
SatGate turns those answers into enforceable policy at the gateway before forwarding to an upstream API, model, or MCP tool happens.
Why static keys fail
Identity is not permission
A verified agent can still be overpowered if the token does not constrain what it can do.
Budgets belong in the credential path
Spend limits, call ceilings, and route policy need to be evaluated before forwarding traffic.
Delegation should narrow
A parent agent should be able to create a narrower child token, never a broader one.
Audit needs token context
Budget spends, and refusals over a budget, a missing payment or a tool permission, emit a receipt with capability hash, remaining budget, route, outcome, decision_reason, policy_version and Evidence Pack id.
Lifecycle demo
Issue → delegate → narrow → revoke → receipt
Issue
Parent gets scoped authority for one tenant, task, budget, and tool set.
Delegate
A child worker receives linked authority from the parent.
Narrow
Child authority shrinks: lower spend cap, fewer tools, shorter TTL, visible depth.
Revoke
SatGate rejects the next governed request at the gateway policy check.
Receipt
The signed receipt shows lineage, caveats, decision, spend, and receipt IDs.
What SatGate checks before forwarding
The credential is only useful if policy is enforced inline, before the expensive or sensitive request reaches the upstream service.
Agent identity
Bind each credential to an agent, task, tenant, workflow, route, model, or MCP server.
Scoped permissions
Limit routes, tools, methods, customers, delegation, and request types instead of issuing broad API keys.
Expiry by default
Make credentials expire with the work: minutes, sessions, jobs, customers, or delegated sub-tasks.
Revocation checks
Block the next request when a token, task, agent, route, or budget is no longer allowed.
Budget caveats
Attach spend caps, call ceilings, per-tool limits, and remaining-budget checks on each request that goes through SatGate.
Narrowed delegation
Let agents delegate narrower credentials to sub-agents without expanding parent authority.
Credential policy example
Mint a scoped agent tokendelegation_depth = 1FAQ
Agent capability token questions
What is an agent capability token?
An agent capability token is a credential that carries constrained authority for an autonomous agent, such as allowed routes, tools, budget, expiry, delegation, and revocation behavior. Macaroons are one implementation pattern.
Why are static API keys risky for AI agents?
Static API keys are broad, long-lived, and hard to delegate safely. Autonomous agents need credentials with scoped authority, budget limits, expiry, revocation, and audit context.
How does SatGate enforce agent credentials?
SatGate checks identity, token scope, route, tool, budget, expiry, delegation rules, and revocation state before the request goes through.
Agent autonomy needs scoped authority, not bigger secrets.
SatGate provides the economic firewall underneath agent credentials: observe who is calling, control what they can spend and access, and revoke authority before the next request.