Verify scoped Grantex grants before Google Agent Development Kit tools run, and add audit recording where required.
Your ADK agents access services with broad credentials. No fine-grained scoping, no delegation control, no tamper-evident audit log of agent actions.
Each ADK agent gets cryptographic identity and scoped JWTs. Delegation chains track multi-agent workflows, and optional audit hooks record actions.
pip install grantex-adk — Python-native integration for Google ADK.
Create an agent identity with specific scopes matching your ADK agent's capabilities.
Obtain scoped grants through the application's configured authorization and consent flow.
Configured ADK tool wrappers verify the JWT and required scope before invoking their protected function.
Optional audit hooks record actions; grant lifecycle remains centrally managed.
from grantex_adk import create_grantex_tool
from google.adk import Agent
calendar_tool = create_grantex_tool(
name='read_calendar',
description='Read upcoming calendar events',
grant_token=token,
required_scope='calendar:read',
func=get_calendar_events,
)
agent = Agent(
model='gemini-2.0-flash',
name='assistant',
tools=[calendar_tool],
)Adapter for the documented Agent Development Kit tool interface. It covers tools explicitly wrapped by the application; other tools are unaffected.
Fine-grained scopes for each capability. "calendar:read" vs "calendar:write".
Multi-agent ADK pipelines with tracked delegation. Central grant state can cascade parent revocation; local verifiers still need current state.
Tools verify JWT signatures and claims before execution; signing keys are obtained from JWKS.
Record authorized tool activity for internal evidence and compliance review workflows.
Enforce per-agent spending limits in the trusted service before executing a metered action.
This integration enforces authorization only where its wrapper or middleware is installed. Local JWT verification checks signatures and claims after JWKS retrieval; it does not prove current revocation unless the verifier performs an online state check or synchronizes revocation data.
Token verification does not create a consent record or prove that a tool executed. Use the configured authorization flow for grant decisions and add an audit integration at the execution boundary when action records are required.
Follow the integration guide and verify the package version before deployment. Apache 2.0.