Add scoped, revocable permissions at configured CrewAI tool boundaries. Each wrapped crew member presents a role-scoped grant that the receiving service verifies.
Your CrewAI agents share the same API keys. If one crew member is compromised, the entire crew's access is exposed. No way to scope or revoke individual agent access.
Each configured crew member can present its own scoped JWT. Wrapped tools enforce the required role scope; unwrapped tools and services remain outside this integration.
pip install grantex-crewai — Python-native integration for CrewAI crews.
Create agent identities with role-specific scopes for each crew member.
Obtain role-scoped grants through the configured authorization flow for each crew member.
Each configured crew member presents its own JWT at wrapped tool or service boundaries. Other crew tools are unaffected until they are integrated.
Attach the audit wrapper to selected tools when action records are required, and manage individual member grants centrally.
from grantex_crewai import create_grantex_tool
research_tool = create_grantex_tool(
name='research',
description='Search approved research sources',
grant_token=researcher_token,
required_scope='search:read',
func=search_tool,
)
write_tool = create_grantex_tool(
name='write_draft',
description='Write a document draft',
grant_token=writer_token,
required_scope='docs:write',
func=save_draft,
)Assign narrow role scopes to each configured crew member, then enforce those scopes at every protected tool or service boundary.
Map CrewAI roles to Grantex scopes. Define authorization policies per role, not per API key.
Use the audit wrapper to record crew tool calls with their grant and agent identifiers.
A lead agent can delegate narrower permissions to sub-agents. Central grant state can cascade a parent revocation to child grants; local verifiers still need current state.
Python adapter for the documented CrewAI tool interface. Validate the CrewAI and adapter versions together before deployment.
Revoke a crew member's grant centrally; each enforcement point must receive current grant state.
This integration enforces authorization only where its wrapper or middleware is installed. Local JWT verification checks signatures and claims after JWKS retrieval; it does not prove current revocation unless the verifier performs an online state check or synchronizes revocation data.
Token verification does not create a consent record or prove that a tool executed. Use the configured authorization flow for grant decisions and add an audit integration at the execution boundary when action records are required.
Follow the integration guide and verify the package version before deployment. Apache 2.0.