AI-Agent Authorization at the Execution Boundary

Besa

Cryptographic admission and evidence for consequential AI-agent actions.

Identity tells you who the agent is. Besa verifies whether this exact operation, resource, and argument set may execute now, then signs evidence of the admitted action and supplied result.

Agent
  ↓  IAM / OAuth / MCP Auth
Besa exact-action admission
  ↓  ALLOW only
Consequential action
  ↓  signed, linked evidence

npm install @dorigjo/besa
npx besa demo

Source, spec, and threat model →

The problem

An agent has valid AWS credentials. Its signed contract permits DEPLOY to staging. It requests DELETE production-db. IAM accepted the identity; Besa returns DENY ACTION_NOT_GRANTED and the executor is not called.

The category

Identity answers who. Besa decides this action.

Besa sits after identity and immediately before the side effect. It evaluates an exact Action Envelope, verifies the signed capability and optional narrowed delegation, consumes replay state, and records signed result evidence.

What Besa proves

Which declared principal, agent, and authority the signed capability binds
The exact tool, operation, resource, scopes, constraints, expiry, and nonce admitted
Whether policy and every narrowed delegation link authorized that exact action
Whether enforced replay protection accepted the action nonce only once
Which signed result evidence links the action, capability, and execution outcome

Try the real deny / allow path

npm install @dorigjo/besa
npx besa demo

# DENY ACTION_NOT_GRANTED
# executor called: no
# ALLOW ACTION_ALLOWED
# evidence verification: EVIDENCE_VALID

# Optional self-hosted verifier
besa serve --port 8787 --action-trust verifier-trust.json

The exact-action contract

A capability is valid only for the canonical action hash it signs. Change the operation, resource, arguments, constraints, expiry, nonce, or delegation and the authorization link no longer matches.

WHO          principal + agent
WHAT         tool + operation
RESOURCE     exact target
CONSTRAINTS  arguments + limits
EXPIRY       bounded time + nonce
DELEGATION   narrowed authority chain

RESULT       signed ALLOW or DENY
EVIDENCE     action hash + supplied result hash

Status

v1.1 protocol. Local SDK and CLI, MCP middleware, and a production-oriented self-hosted HTTP verifier with health/readiness probes, request limits, rate limiting, token-protected admission, keyless verification mode, Docker deployment, tests, and conformance vectors. Besa does not operate an official public verifier instance. No independent third-party security audit has been performed.

Source: github.com/dorigjo/besa