$ import json from openai import OpenAI llm = OpenAI() # The system prompt defines what this agent is and what tools it can call. system_prompt = """You are a customer support agent. You have these tools: - lookup_billing: Fetch billing history for a customer - edit_account: Edit a customer's account info - lookup_billing_all: Fetch billing history across all customers Use the appropriate tool based on the customer's request.""" # A request arrives. The LLM decides what tool to call. response = llm.chat.completions.create( model="gpt-4.1", messages=[ {"role": "system", "content": system_prompt}, {"role": "user", "content": "What's the billing history for customer 12345?"}, ], tools=tools, # lookup_billing, edit_account, lookup_billing_all ) # The LLM chose lookup_billing for customer 12345. # Extract the customer_id from the LLM's decision. tool_call = response.choices[0].message.tool_calls[0] args = json.loads(tool_call.function.arguments) customer_id = args["customer_id"] # "12345" # Now: how does the agent get the credential to make that call? import json from openai import OpenAI llm = OpenAI() # The system prompt defines what this agent is and what tools it can call. system_prompt = """You are a customer support agent. You have these tools: - lookup_billing: Fetch billing history for a customer - edit_account: Edit a customer's account info - lookup_billing_all: Fetch billing history across all customers Use the appropriate tool based on the customer's request.""" # A request arrives. The LLM decides what tool to call. response = llm.chat.completions.create( model="gpt-4.1", messages=[ {"role": "system", "content": system_prompt}, {"role": "user", "content": "What's the billing history for customer 12345?"}, ], tools=tools, # lookup_billing, edit_account, lookup_billing_all ) # The LLM chose lookup_billing for customer 12345. # Extract the customer_id from the LLM's decision. tool_call = response.choices[0].message.tool_calls[0] args = json.loads(tool_call.function.arguments) customer_id = args["customer_id"] # "12345" # Now: how does the agent get the credential to make that call? import json from openai import OpenAI llm = OpenAI() # The system prompt defines what this agent is and what tools it can call. system_prompt = """You are a customer support agent. You have these tools: - lookup_billing: Fetch billing history for a customer - edit_account: Edit a customer's account info - lookup_billing_all: Fetch billing history across all customers Use the appropriate tool based on the customer's request.""" # A request arrives. The LLM decides what tool to call. response = llm.chat.completions.create( model="gpt-4.1", messages=[ {"role": "system", "content": system_prompt}, {"role": "user", "content": "What's the billing history for customer 12345?"}, ], tools=tools, # lookup_billing, edit_account, lookup_billing_all ) # The LLM chose lookup_billing for customer 12345. # Extract the customer_id from the LLM's decision. tool_call = response.choices[0].message.tool_calls[0] args = json.loads(tool_call.function.arguments) customer_id = args["customer_id"] # "12345" # Now: how does the agent get the credential to make that call? # Same LLM decision. Same customer_id extracted above. # The credential is a shared key baked into the environment. api_key = os.environ["SHARED_API_KEY"] headers = {"Authorization": f"Bearer {api_key}"} result = requests.get( f"https://api.example.com/customers/{customer_id}/billing", headers=headers, ) # This works. But that same key could also call: # requests.get("https://api.example.com/customers", headers=headers) # ...and pull EVERY customer. The key doesn't know or care # that the LLM only asked for one. And it never expires. # Same LLM decision. Same customer_id extracted above. # The credential is a shared key baked into the environment. api_key = os.environ["SHARED_API_KEY"] headers = {"Authorization": f"Bearer {api_key}"} result = requests.get( f"https://api.example.com/customers/{customer_id}/billing", headers=headers, ) # This works. But that same key could also call: # requests.get("https://api.example.com/customers", headers=headers) # ...and pull EVERY customer. The key doesn't know or care # that the LLM only asked for one. And it never expires. # Same LLM decision. Same customer_id extracted above. # The credential is a shared key baked into the environment. api_key = os.environ["SHARED_API_KEY"] headers = {"Authorization": f"Bearer {api_key}"} result = requests.get( f"https://api.example.com/customers/{customer_id}/billing", headers=headers, ) # This works. But that same key could also call: # requests.get("https://api.example.com/customers", headers=headers) # ...and pull EVERY customer. The key doesn't know or care # that the LLM only asked for one. And it never expires. # Same LLM decision. Same customer_id. # We know we only need one customer. But OAuth scopes are defined # at the client level, not per-task. You can't mint a token for # "just customer 12345" without a separate OAuth client per customer. token = get_oauth_token(client_id=os.environ["CLIENT_ID"], client_secret=os.environ["CLIENT_SECRET"], scope="read:customers:*") # broad because it has to be headers = {"Authorization": f"Bearer {token}"} result = requests.get( f"https://api.example.com/customers/{customer_id}/billing", headers=headers, ) # This also works. But the token can read ALL customers, # and it's valid for 60 minutes. Agent is done in 2. # Same LLM decision. Same customer_id. # We know we only need one customer. But OAuth scopes are defined # at the client level, not per-task. You can't mint a token for # "just customer 12345" without a separate OAuth client per customer. token = get_oauth_token(client_id=os.environ["CLIENT_ID"], client_secret=os.environ["CLIENT_SECRET"], scope="read:customers:*") # broad because it has to be headers = {"Authorization": f"Bearer {token}"} result = requests.get( f"https://api.example.com/customers/{customer_id}/billing", headers=headers, ) # This also works. But the token can read ALL customers, # and it's valid for 60 minutes. Agent is done in 2. # Same LLM decision. Same customer_id. # We know we only need one customer. But OAuth scopes are defined # at the client level, not per-task. You can't mint a token for # "just customer 12345" without a separate OAuth client per customer. token = get_oauth_token(client_id=os.environ["CLIENT_ID"], client_secret=os.environ["CLIENT_SECRET"], scope="read:customers:*") # broad because it has to be headers = {"Authorization": f"Bearer {token}"} result = requests.get( f"https://api.example.com/customers/{customer_id}/billing", headers=headers, ) # This also works. But the token can read ALL customers, # and it's valid for 60 minutes. Agent is done in 2. from agentwrit import AgentWritApp from agentwrit.errors import AuthorizationError app = AgentWritApp( broker_url=os.environ["AGENTWRIT_BROKER_URL"], client_id=os.environ["AGENTWRIT_CLIENT_ID"], client_secret=os.environ["AGENTWRIT_CLIENT_SECRET"], ) # Same LLM decision. Same customer_id. # But now the credential is scoped to exactly what the LLM asked for. try: agent = app.create_agent( orch_id="billing-agent", task_id=f"billing-{customer_id}", requested_scope=[f"read:data:customer-{customer_id}"], ) except AuthorizationError as e: # Broker says no. Scope exceeds what this app is allowed to issue. print(e.problem.detail) # "scope exceeds app ceiling" print(e.problem.error_code) # "scope_violation" raise # Verify the token through the app. Returns the broker's signed claims. check = app.validate(agent.access_token) print(check.claims.scope) # ['read:data:customer-12345'] -- nothing else result = httpx.get( f"https://api.example.com/customers/{customer_id}/billing", headers=agent.bearer_header, ) # This works. But if something tries to pull ALL customers # with this token, the API checks the scope and rejects it. # Done. Kill the token at the broker. Right now. Not in 58 minutes. agent.release() from agentwrit import AgentWritApp from agentwrit.errors import AuthorizationError app = AgentWritApp( broker_url=os.environ["AGENTWRIT_BROKER_URL"], client_id=os.environ["AGENTWRIT_CLIENT_ID"], client_secret=os.environ["AGENTWRIT_CLIENT_SECRET"], ) # Same LLM decision. Same customer_id. # But now the credential is scoped to exactly what the LLM asked for. try: agent = app.create_agent( orch_id="billing-agent", task_id=f"billing-{customer_id}", requested_scope=[f"read:data:customer-{customer_id}"], ) except AuthorizationError as e: # Broker says no. Scope exceeds what this app is allowed to issue. print(e.problem.detail) # "scope exceeds app ceiling" print(e.problem.error_code) # "scope_violation" raise # Verify the token through the app. Returns the broker's signed claims. check = app.validate(agent.access_token) print(check.claims.scope) # ['read:data:customer-12345'] -- nothing else result = httpx.get( f"https://api.example.com/customers/{customer_id}/billing", headers=agent.bearer_header, ) # This works. But if something tries to pull ALL customers # with this token, the API checks the scope and rejects it. # Done. Kill the token at the broker. Right now. Not in 58 minutes. agent.release() from agentwrit import AgentWritApp from agentwrit.errors import AuthorizationError app = AgentWritApp( broker_url=os.environ["AGENTWRIT_BROKER_URL"], client_id=os.environ["AGENTWRIT_CLIENT_ID"], client_secret=os.environ["AGENTWRIT_CLIENT_SECRET"], ) # Same LLM decision. Same customer_id. # But now the credential is scoped to exactly what the LLM asked for. try: agent = app.create_agent( orch_id="billing-agent", task_id=f"billing-{customer_id}", requested_scope=[f"read:data:customer-{customer_id}"], ) except AuthorizationError as e: # Broker says no. Scope exceeds what this app is allowed to issue. print(e.problem.detail) # "scope exceeds app ceiling" print(e.problem.error_code) # "scope_violation" raise # Verify the token through the app. Returns the broker's signed claims. check = app.validate(agent.access_token) print(check.claims.scope) # ['read:data:customer-12345'] -- nothing else result = httpx.get( f"https://api.example.com/customers/{customer_id}/billing", headers=agent.bearer_header, ) # This works. But if something tries to pull ALL customers # with this token, the API checks the scope and rejects it. # Done. Kill the token at the broker. Right now. Not in 58 minutes. agent.release() - Shared -weight: 500;">service account with a static API key. Every agent uses the same key. When one gets compromised, you rotate the key and everything breaks. - OAuth token with a 15-60 minute TTL. The agent runs for a short task, but the credential stays valid much longer. - Broad IAM role assigned "just in case." Scoped wide enough to handle every possible task. When an agent gets compromised, it has access to everything. - Ephemeral identity: Every agent spawns with a unique cryptographic identity - Task-scoped tokens: Scoped to exactly what the task needs, not broad IAM roles - Short-lived credentials: Tokens expire in minutes and can be released or revoked early - Four-level revocation: Token, agent, task, or full delegation chain - Delegation chain verification: Permissions cannot expand at each hop, cryptographically enforced