Capability tokens
What it does
Every call carries a short-lived, signed token scoped to only the tools the agent may use. Anything outside that scope is rejected at the gateway.
Each agent carries a short-lived, signed token scoped to only the tools it may use. The gateway verifies the token on every call and rejects anything outside its scope, so a compromised agent can only reach what its token permits.
When it applies
On every routed call, the token is checked before anything else runs.
How it works
Every agent presents a signed capability token on each call. The gateway verifies the signature and checks the requested tool against the token's scope before anything else runs. An out-of-scope tool is rejected at the door, and each token also carries the tenant it belongs to and its budget.
In practice
A support agent is issued a token scoped to search and read_docs. If it is manipulated into calling delete_record, the call is refused because that tool is not in its token, regardless of what any policy says.
What you get
Every mint and every out-of-scope rejection is written to the audit log with the token id, so the agent's allowed surface and its attempts are both on record.
Why it matters
A compromised agent's reach is bounded by design, not by hope.
Static, broad credentials are the root cause of agent blast radius: a prompt-injected agent with valid credentials can do anything the credential allows. Capability tokens replace that with least privilege, scoped and short-lived, so a compromise is contained to a few tools instead of the whole estate.