Agent capability tokens say what an agent can do — not just who it is
Identity proves the caller. Capability proves authority. For autonomous agents, the token should encode routes, tools, budgets, expiry, delegation limits, and revocation checks before access is granted.
Credentials have to carry economic policy
Human access systems assume stable users, managed devices, predictable sessions, and human-scale request rates. Agent systems are different: credentials can be copied into tools, delegated to sub-agents, retried in loops, and used faster than a billing alert can fire.
The safe model is not a single permanent secret. It is a request-path capability that answers: what can this agent do, on which route, for how long, with what budget, and can it still be revoked right now?
SatGate turns those answers into enforceable policy before upstream API, model, or MCP tool access happens.
Why static keys fail
Identity is not authority
A verified agent can still be overpowered if the token does not constrain what it can do.
Budgets belong in the credential path
Spend limits, call ceilings, and route policy need to be evaluated before forwarding traffic.
Delegation should attenuate
A parent agent should be able to create a narrower child token, never a broader one.
Audit needs token context
Every decision should record identity, capability, caveats, remaining budget, route, and outcome.
What SatGate checks before forwarding
The credential is only useful if policy is enforced inline, before the expensive or sensitive request reaches the upstream service.
Agent identity
Bind each credential to an agent, task, tenant, workflow, route, model, or MCP server.
Scoped authority
Limit routes, tools, methods, customers, delegation, and request types instead of issuing broad API keys.
Expiry by default
Make credentials expire with the work: minutes, sessions, jobs, customers, or delegated sub-tasks.
Revocation checks
Block the next request when a token, task, agent, route, or budget is no longer allowed.
Budget caveats
Attach spend caps, call ceilings, per-tool limits, and remaining-budget checks to the request path.
Attenuated delegation
Let agents delegate narrower credentials to sub-agents without expanding parent authority.
Credential policy example
agent: research-agent-17
scope:
routes: [/api/research/*]
tools: [web_search, document_fetch]
budget:
max_usd: 25
max_calls: 300
delegation:
allowed: true
child_budget_max_usd: 5
child_ttl_minutes: 15
expiry: 2026-04-26T14:00:00Z
revocation:
check: before_each_request
audit:
fields: [agent, route, tool, budget_remaining, decision]Agent autonomy needs scoped authority, not bigger secrets.
SatGate provides the economic firewall underneath agent credentials: observe who is calling, control what they can spend and access, and revoke authority before the next request.