What I learned trying to revoke an AI agent mid-task

Short summary

The author identifies four key problems with revoking AI agents mid-task: conflating identity with credentials, slow token-refresh-based revocation, unsafe credential delegation, and unreliable post-hoc audit logs. They propose splitting identity from credentials, enforcing revocation at the action path via a proxy, structurally narrowing delegation, and making the audit log a byproduct of enforcement. These ideas are implemented in Chancery, an open-source Go binary.

• •Separate agent identity from credentials so revocation targets one grant, not a shared API key
• •Enforce revocation at the tool-call path via proxy, not at token refresh
• •Delegation should structurally narrow scope; audit logs should be enforcement byproducts

Generated with AI, which can make mistakes.