Runtime authorization & controls
Apache-2.0 relationship-based authorization engine whose documentation models agents as first-class principals with narrowly scoped, revocable, optionally time-limited grants, including MCP tool-level checks and permission-filtered retrieval. It answers authorization questions but does not intercept traffic, so an application or gateway must call it.
open_source · generally available · Research snapshot 2026-09-06
Visit the official product source ↗Runtime authorization & controls · Agent identity & access
Useful conversation with: Application security architect, IAM engineer, Platform engineer.
Show me an OpenFGA model where an agent receives a task-scoped grant to two MCP tools with a turn limit, then revoke the agent without touching the user's permissions.
Support labels reflect the supplied research. Documentation and vendor claims are not independent product tests. “Not established” means the researcher did not find support; it does not prove a capability is absent.
Documented by provider
OpenFGA documentation models agents as first-class principals that appear in authorization tuples, receive delegated rather than copied permissions, and can be revoked independently of the user they serve.
Limit: Modelling guidance is not an enforcement mechanism; interception must be built by the adopter.
Documented by provider
Agents can start with zero permissions and receive narrowly scoped grants per task, with optional expiration, turn limits and agent binding, and MCP tool access can be controlled per user by role, group and temporal grant.
Limit: Documented as modelling patterns; no reference implementation of an MCP interceptor is provided on these pages.
Documented by provider
OpenFGA is an Apache-2.0 licensed, high-performance authorization engine inspired by Google Zanzibar with HTTP and gRPC APIs.
Limit: Repository evidence does not establish a vendor support commitment.
Listing does not imply partnership, supplier status, a working DutyGraph integration, or a compliance certification.
Suggest a correction