Runtime identity · Per-action authorization · for AI agents
Verify the agent behind every action.
Valid credentials do not prove which agent is actually acting. Auth51 derives identity from the running agent's observed system prompt, tools, and configuration, then binds each approved action to a per-action token enforced at the resource server.
Agents · Registered
Patchet12 agents
| Agent ID | Role | Reasoning | Provenance | Registered |
|---|---|---|---|---|
Supervisorlive | Orchestrator↳ 3 | Plan-and-execute | Production | just now |
Planner | Tool-agent↑ 1 | ReAct loop | Production | 1m ago |
Classifier | Tool-agent↑ 1 | Direct execution | Production | 1m ago |
Patcher | Tool-agent↑ 1 | Direct execution | Production | 1m ago |
T2MaliciousPlanner | Worker | Direct execution | T2 · malicious | 1m ago |
T7Planner | Worker | Direct execution | T7 | 1m ago |
Verifier | Worker | Direct execution | Production | just now |
Auditor | Worker | Direct execution | Production | just now |
T9TokenReplay | Worker | Direct execution | T9 | just now |
SBOMGenerator | Worker | Direct execution | Production | just now |
VulnTriager | Worker | Direct execution | Production | just now |
PRBuilder | Worker | Direct execution | Production | just now |
Runtime identity enforcement
Agent identity is derived at runtime and authorization is enforced at the resource.
Auth51 does not trust an agent to declare its own identity. The Runtime derives a fingerprint from observed data, the Authority verifies the identity and applicable grant, and the Verifier enforces the per-action token at the resource boundary.
Enforcement path
Observe → authorize → enforce
| Observe | Runtime fingerprints the executing agent |
| Authorize | Authority verifies identity and grant |
| Bind | Per-action token carries signed claims |
| Enforce | Verifier checks claims at the resource boundary |
Feature · Live Registry
Continuously verify registered agents.
The Auth51 Console provides a real-time view of agents registered with the Authority. It shows each agent's runtime fingerprint and classification in one place.
| Agent | Role | Reasoning | Tools |
|---|---|---|---|
| Supervisor | Orchestrator | Plan-and-execute | 3 |
| Planner | Tool-agent | ReAct loop | 4 |
| Classifier | Tool-agent | Direct execution | 3 |
| Patcher | Tool-agent | Direct execution | 2 |
| T2MaliciousPlanner | Worker | Direct execution | 1 |
- Cryptographic fingerprintingAt registration, Auth51 hashes the agent's prompt, tools, and configuration into a checksum. A changed checksum causes the next token mint to fail.
- Five-dimensional classificationAuth51 derives role, reasoning pattern, autonomy level, capability surface, and provenance from observable data instead of accepting self-declared classifications.
- Live updatesNew registrations appear within seconds, versioning reveals drift, and revocations take effect immediately.
Feature · Discovery
Discover unregistered agents before they can act.
The Runtime monitors each host on which it is installed. An unfamiliar process that loads the shim appears in the Discovered queue before it can mint a token.
- !PrCheckeron agents-prod-02checksum 9e1a7b8c4d2f… · detected 12s ago
- !IssueRouter-v2on agents-prod-01checksum a4b5c6d7e8f9… · detected 2m ago
- !CodeRevieweron agents-stage-01checksum f3e2d1c0b9a8… · detected 7m ago
Zero-trust by default
An unregistered agent has no identity in the Authority, so it cannot mint tokens or access protected resources. Another agent cannot impersonate an identity that has not been registered.
Compare the discovered fingerprint with the expected release artifact. Approve the registration when they match; otherwise, investigate the deployment before it can act.
Feature · Workflows
Inspect inferred, registered, and runtime workflows.
The Console derives orchestration from the tool graph, displays registered WorkflowDefinitions, and will compare runtime traces with those declarations.
▾ Supervisor Orchestrator · Plan ├ ▸ Planner Tool-agent · ReAct ├ ▸ Classifier Tool-agent · Direct └ ▸ Patcher Tool-agent · Direct ▾ T7Supervisor Orchestrator · Plan threat T7 ├ ▸ T7Planner Tool-agent · Direct threat T7 └ ▸ T7Patcher Tool-agent · Direct threat T7
Inferred from the tool graph
An agent whose tools include other agents is treated as a workflow root. Auth51 traces its children recursively, so the delegation structure becomes visible as soon as the agents register.
Use this view to confirm what was deployed, investigate why an agent has access, and identify scope creep.
Empirical evaluation
Auth51 blocked the attack in all 12 implemented scenarios.
Each scenario below runs against both an OAuth-only baseline and an Auth51-protected configuration. In these tests, the OAuth-only baseline blocked none; Auth51 blocked all 12.
Identity Federation
Federate identity without exposing client secrets to the browser.
The Console uses short-lived JWTs to assert the signed-in user. Each Authority validates those assertions and issues its own user-bound tokens. The browser does not receive client secrets or refresh tokens. This exchange follows RFC 8693.
- Use one console session across Authorities.Sign in once through Clerk or SSO and switch among development, staging, and production Authorities. Each Authority issues its own short-lived token.
- Preserve user identity in audit records.Each action carries the user's identity rather than a shared service-account identity, so audit logs record who initiated it.
- Use existing OAuth and JWT infrastructure.Auth51 uses RFC 8693 token exchange, RFC 9440 proof-of-possession, and the Agentic JWT IETF Internet-Draft. Existing JWT libraries can process the resulting tokens.
Get started
Integrate Auth51 with a single import.
Add the client library to the agent process and configure it with an Authority. Outbound calls then carry identity- and intent-bound tokens and appear in audit logs. The client integration requires no sidecar or changes to agent or tool logic.
$ pip install auth51
# Once, at process startup.
import auth51
auth51.configure(
app_id="acme",
client_id="a51_live_...", # from the console
client_secret="...", # shown once
audiences={"api.acme.com"}, # hosts to govern
)
# Bind a run to your registered agent's identity.
# Inside the context, every outbound call mints a fresh
# intent token, carries the agent's checksum, and is
# DPoP-signed in-process. No auth code in your tools.
with auth51.agent("checkout-bot", checksum=cs,
scope="payment:execute",
audience="api.acme.com"):
run_agent()$ brew install auth51/tap/a51
$ a51 connect https://authority.auth51.com
✓ Connected to Authority at authority.auth51.com
$ a51 agents list patchet
Supervisor Orchestrator Plan-and-execute ↳ 3
Planner Tool-agent ReAct loop 4 tools
Classifier Tool-agent Direct execution 3 tools
Patcher Tool-agent Direct execution 2 tools
$ a51 apply -f secure_deploy_v1.0.yaml
✓ workflow secure_deploy_v1.0 registered
$ a51 threats run T7
running T7 cross-agent privilege escalation…
✗ OAuth succeeded (token replayed across agents)
✓ Auth51 blocked (A7 + A8 caught at IDP)Evaluate Auth51 with a working agent.
Open the Console and register an agent to inspect identity-bound, auditable calls. The walkthrough demonstrates the same flow against live endpoints.