Identity · Intent · Audit · for AI agents
The control plane your AI agents need before production.
Auth51 fingerprints every agent at runtime, binds every action to a declared intent, and rejects every call that doesn't match. Built on OAuth 2.0 Token Exchange and the Agentic JWT IETF draft.
Agents · Registered
Patchet12 agents
| Agent ID | Role | Reasoning | Provenance | Registered |
|---|---|---|---|---|
Supervisorlive | Orchestrator↳ 3 | Plan-and-execute | Production | just now |
Planner | Tool-agent↑ 1 | ReAct loop | Production | 1m ago |
Classifier | Tool-agent↑ 1 | Direct execution | Production | 1m ago |
Patcher | Tool-agent↑ 1 | Direct execution | Production | 1m ago |
T2MaliciousPlanner | Worker | Direct execution | T2 · malicious | 1m ago |
T7Planner | Worker | Direct execution | T7 | 1m ago |
Verifier | Worker | Direct execution | Production | just now |
Auditor | Worker | Direct execution | Production | just now |
T9TokenReplay | Worker | Direct execution | T9 | just now |
SBOMGenerator | Worker | Direct execution | Production | just now |
VulnTriager | Worker | Direct execution | Production | just now |
PRBuilder | Worker | Direct execution | Production | just now |
The Control Plane
It's kubectl for AI agents. Same primitives. New domain.
Authority at the top, Runtimes embedded in your agents, Verifiers at every resource boundary, Console and CLI as your view. If you can deploy a Kubernetes cluster, you already know how to deploy Auth51.
If you know K8s
Translation table
| API server / etcd | Auth51 Authority |
| kubelet (per node) | Auth51 Runtime |
| Admission / sidecar | Auth51 Verifier |
| K8s Dashboard | Auth51 Console |
| kubectl | a51 CLI |
| kubeconfig | a51 config |
| Workload / Pod | Agentic application |
| kubectl apply -f | a51 apply -f |
Feature · Live Registry
Every agent. Verified. Continuously.
The Auth51 Console gives you a real-time view of every agent registered with the Authority — fingerprinted at runtime, classified by behaviour, observable from one pane.
| Agent | Role | Reasoning | Tools |
|---|---|---|---|
| Supervisor | Orchestrator | Plan-and-execute | 3 |
| Planner | Tool-agent | ReAct loop | 4 |
| Classifier | Tool-agent | Direct execution | 3 |
| Patcher | Tool-agent | Direct execution | 2 |
| T2MaliciousPlanner | Worker | Direct execution | 1 |
- Cryptographic fingerprintingEvery agent's prompt, tools, and configuration are hashed into a checksum at registration. If anything changes, the next token mint fails.
- Five-dimensional classificationRole, reasoning pattern, autonomy level, capability surface, provenance — all derived from observable data. The system interprets agents; agents don't self-declare.
- Live updatesNew registrations appear within seconds. Versioning detects drift. Revocation propagates immediately.
Feature · Discovery
Agents appear. We catch them.
The Runtime watches every host it's installed on. Any unfamiliar process that loads the shim shows up in your Discovered inbox — before it can mint a single token.
- !PrCheckeron agents-prod-02checksum 9e1a7b8c4d2f… · detected 12s ago
- !IssueRouter-v2on agents-prod-01checksum a4b5c6d7e8f9… · detected 2m ago
- !CodeRevieweron agents-stage-01checksum f3e2d1c0b9a8… · detected 7m ago
Zero-trust by default
An unregistered agent has no identity in the Authority. It can't mint tokens, can't access resources, can't be impersonated by another agent — because it doesn't exist yet.
Review the discovery. If the fingerprint matches your release artifact, register with one click. If it doesn't, you've just caught a rogue deployment before it could act.
Feature · Workflows
From inferred topology to live execution.
Three lenses on the same multi-agent system. The Console derives orchestration from the tool graph automatically, surfaces declared WorkflowDefinitions, and (soon) replays actual runtime traces against them.
▾ Supervisor Orchestrator · Plan ├ ▸ Planner Tool-agent · ReAct ├ ▸ Classifier Tool-agent · Direct └ ▸ Patcher Tool-agent · Direct ▾ T7Supervisor Orchestrator · Plan threat T7 ├ ▸ T7Planner Tool-agent · Direct threat T7 └ ▸ T7Patcher Tool-agent · Direct threat T7
Inferred from the tool graph
Every orchestrator agent — one whose tools include other agents — becomes a workflow root. Children are traced recursively. No declaration needed. As soon as agents register, their delegation structure is visible.
Useful for: understanding what you actually deployed, debugging “why does this agent have this access,” catching scope creep.
Empirical evaluation
12 known agentic attacks. All 12 blocked.
Every threat below is implemented as a runnable scenario, executed against both an OAuth-only baseline and an Auth51-protected configuration. OAuth succeeded on every attack. Auth51 blocked every attack.
Identity Federation
Identity federated. Secrets never seen.
The Console signs short-lived JWTs asserting who you are. Each Authority verifies them and issues its own tokens, bound to your user. Your browser never holds client_secrets, refresh tokens, or anything else dangerous. Built on RFC 8693 Token Exchange.
- One sign-in. Many control planes.Sign into the Console once via Clerk / SSO. Switch between dev, staging, and prod Authorities like kubectl context-switches between clusters. Each one issues its own short-lived token.
- Audit per-human, not per-client.Every action carries your actual identity in the token, not a shared service-account. Audit logs answer who, not just what.
- Standards-based.RFC 8693 token exchange. RFC 9440 message signatures. Agentic JWT IETF draft. No proprietary protocol — your existing JWT libraries already understand the tokens.
Get started
Install. Register. Done.
Drop the shim into your agent process, point it at an Authority, and every outbound call is identity-bound, intent-bound, and audit-logged. No service to run, no sidecar to deploy.
$ pip install auth51-shim
# In your agent process
from auth51 import init_security, get_secure_client
await init_security(
app_id="patchet",
idp_url="https://idp.auth51.com",
)
client = get_secure_client()
# Every outbound call now mints a fresh intent token,
# carries the agent's checksum, and is bound to the
# current workflow step. PoP signed in-process.
res = await client.post(
"https://api.openai.com/v1/chat/completions",
json={...},
intent="generate_response",
)$ brew install auth51/tap/a51
$ a51 connect https://idp.auth51.com
✓ Connected to Authority at idp.auth51.com
$ a51 agents list patchet
Supervisor Orchestrator Plan-and-execute ↳ 3
Planner Tool-agent ReAct loop 4 tools
Classifier Tool-agent Direct execution 3 tools
Patcher Tool-agent Direct execution 2 tools
$ a51 apply -f secure_deploy_v1.0.yaml
✓ workflow secure_deploy_v1.0 registered
$ a51 threats run T7
running T7 cross-agent privilege escalation…
✗ OAuth succeeded (token replayed across agents)
✓ Auth51 blocked (A7 + A8 caught at IDP)Ship agents you can defend in production.
Open the Console, register your first agent, and watch every call get identity-bound and audit-logged. Or just curl the live endpoints and see for yourself.