Delegated Authorization for AI Agents

Scope Enforcement — Control What Agents Can Do

Enforce tool-level permissions on any connector you define. Bring your own manifests or use the 53 pre-built ones. Verification is local after key retrieval; reusable JWKS resolvers avoid repeat fetches while valid, but initial retrieval and rotation refreshes require network access.

# Any connector. 5 lines.
from grantex import ToolManifest, Permission

grantex.load_manifest(ToolManifest(
    connector="my-crm",
    tools={
        "search":  Permission.READ,
        "create":  Permission.WRITE,
        "delete":  Permission.DELETE,
    },
))

# enforce() works immediately
grantex.enforce(token, "my-crm", "delete")

Works with any connector. 53 pre-built manifests included to get you started:

AI agents are acting without permission

Today's AI frameworks offer no standard way to authorize, audit, or revoke what agents do on behalf of humans.

Attackers have already figured this out

Agents use shared secrets with no identity, no scoping, and no revocation. The numbers from 2025 speak for themselves.

Confirmed 2025–2026 incidents

Read the full analysis: 4 Agent Security Breaches That Should Change How You Think About API Keys

When an agent acts, can you attribute the decision?

Use Grantex alongside secrets and identity systems

HashiCorp Vault, AWS Secrets Manager, Doppler, and identity providers already offer important controls. Grantex adds agent-specific delegated authority at the action boundary; it does not replace those systems.

Evidence review: Read the documentation-based 15-project authorization review · See architecture comparisons

The regulatory pressure is already here

OWASP guidance, the EU AI Act, and the NIST AI RMF all increase the focus on identity, authorization, human oversight, and auditability. Grantex supplies technical building blocks; each deployer remains responsible for its own compliance assessment.

Full mapping: Compliance Matrix · OWASP deep-dive blog post

Delegated authorization, done right

Five steps from consent to revocation, all enforced by cryptography.

Up and running in minutes

Choose an SDK. These pinned commands reproduce the releases verified above; each follows the same consent, token exchange, and verification lifecycle.

// npm install @grantex/sdk@0.5.1
import { Grantex, verifyGrantToken } from '@grantex/sdk';

const grantex = new Grantex({ apiKey: 'YOUR_API_KEY' });

// 1. Request authorization; live mode returns the code to your callback.
const auth = await grantex.authorize({
  agentId:  'ag_01J...',
  userId:   'usr_01J...',
  scopes:  ['calendar:read', 'email:send'],
  audience: 'https://api.example.com',
});

if (!auth.code) {
  console.log(`Approve access at: ${auth.consentUrl}`);
  // Exchange the callback's code in your redirect handler.
} else {
  // 2. Sandbox or policy auto-approval can return a code immediately.
  const token = await grantex.tokens.exchange({ code: auth.code, agentId: 'ag_01J...' });

  // 3. Verify locally; retrieving or refreshing JWKS may use the network.
  const grant = await verifyGrantToken(token.grantToken, {
    jwksUri: 'https://api.grantex.dev/.well-known/jwks.json',
    audience: 'https://api.example.com',
  });
  console.log(grant.scopes); // ['calendar:read', 'email:send']
}

# python -m pip install grantex==0.4.1
from grantex import AuthorizeParams, ExchangeTokenParams, Grantex

client = Grantex(api_key="YOUR_API_KEY")

# 1. Request authorization; live mode returns the code to your callback.
auth = client.authorize(AuthorizeParams(
    agent_id="ag_01J...",
    user_id="usr_01J...",
    scopes=["calendar:read", "email:send"],
    audience="https://api.example.com",
))

if not auth.code:
    print(f"Approve access at: {auth.consent_url}")
    # Exchange the callback code in your redirect handler.
else:
    # 2. Sandbox or policy auto-approval can return a code immediately.
    token = client.tokens.exchange(ExchangeTokenParams(code=auth.code, agent_id="ag_01J..."))

    # 3. Use the token — scopes, grant ID, and JWT are available.
    print(token.scopes)      # ('calendar:read', 'email:send')
    print(token.grant_token) # RS256-signed JWT

// go get github.com/mishrasanjeev/grantex-go@v0.2.1
package main

import (
	"context"
	"fmt"
	"log"

	grantex "github.com/mishrasanjeev/grantex-go"
)

func main() {
	ctx := context.Background()
	client := grantex.NewClient("YOUR_API_KEY")
	auth, err := client.Authorize(ctx, grantex.AuthorizeParams{
		AgentID:     "ag_01J...",
		PrincipalID: "usr_01J...",
		Scopes:      []string{"calendar:read", "email:send"},
		Audience:    "https://api.example.com",
	})
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(auth.ConsentURL)
	token, err := client.Tokens.Exchange(ctx, grantex.ExchangeTokenParams{
		Code:    "authorization-code-from-callback",
		AgentID: "ag_01J...",
	})
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(token.GrantToken)
}

# npm install -g @grantex/cli@0.3.0
# All commands support --json for AI agent / script use

# 1. Request authorization (sandbox auto-approves)
grantex authorize --agent ag_01J... --principal user_123 \
  --scopes calendar:read,email:send

# 2. Exchange the code for a grant token
grantex tokens exchange --code <code> --agent-id ag_01J...

# 3. Verify the token
grantex tokens verify <jwt>

# Machine-readable output
grantex --json grants list | jq '.[0].grantId'

OACP Authority And Agent Identity

MPP defines a machine-payment flow. Grantex can attach signed agent, principal, category, and spending-limit claims that an integrating merchant verifies and enforces; Grantex does not execute or guarantee a payment.

Open Agentic Commerce Protocol (OACP) is Grantex's agentic-commerce trust and artifact-authority layer. Grantex governs policy, internal artifact issuance or refusal, verification, and compatibility adapters. AgenticOrg runs seller and buyer agents, Shopify connector runtime, buyer surfaces, purchase preparation, and Offline POS handoff orchestration. Merchant, POS, and payment providers remain source of record for final execution.

import { requireAgentPassport } from '@grantex/mpp';

// One line to protect any route
app.use('/api/inference', requireAgentPassport({
  requiredCategories: ['inference'],
  maxAmount: 10,
}));

// req.agentPassport is populated:
//   humanDID:    did:grantex:user_alice
//   orgDID:      did:web:acme.com
//   categories:  [inference, compute]
//   maxAmount:   50 USDC
//   depth:       0 (direct grant)

const passport = await grantex.passports.issue({
  agentId: 'ag_01HXYZ...',
  grantId: 'grnt_01HXYZ...',
  allowedMPPCategories: ['inference', 'compute'],
  maxTransactionAmount: { amount: 50, currency: 'USDC' },
});
const mw = createMppPassportMiddleware({ passport });

Prepaid Wallets for x402 v2

Assign one or many prepaid wallets to an AI agent. Compose assignment, wallet, agent, budget-group, principal, and tenant limits; require exact human approval; govern reloads; and stop one wallet or every wallet without loosening the x402 protocol.

import { PrepaidWalletAgentClient } from '@grantex/sdk';
import { createX402Agent } from '@grantex/x402';

const walletAgent = new PrepaidWalletAgentClient({
  oauthClient, accessToken
});

const x402 = createX402Agent({
  authorizePayment: walletAgent.x402Authorizer
});

const response = await x402.fetch(
  'https://merchant.example/weather'
);

// Official headers:
// PAYMENT-REQUIRED
// PAYMENT-SIGNATURE
// PAYMENT-RESPONSE

// Grantex reserves and enforces policy
// before the signed retry is created.

Works with your stack

Drop Grantex into any AI framework or language runtime.

Runnable code you can copy

End-to-end examples for every SDK and framework integration. Clone the repo, start the local stack, and run.

Built to enterprise standards

Published security assessment, individual IETF Internet-Draft, open source.

Join the Grantex community

Connect with developers building the trust layer for AI agents.