Illustrative sector walk-through — it shows how KYE Protocol™ would govern an API gateway & identity stack and does not imply an existing deployment or commercial relationship with any vendor.
An AI agent requested an API scope it was never delegated. KYE™ refused the call.
Built for a platform like yours. Your API gateway and identity server already broker tokens and scopes between clients, services and users — and now AI agents call those APIs on someone’s behalf. KYE Protocol™ checks the agent’s delegated scope at the moment of the call — and refuses any invocation beyond what its principal actually granted. Each refusal is sealed as a receipt your security team can replay, cutting an access-abuse investigation from days to minutes.
You keep your platform. KYE™ governs the scope boundary.
Your platform already issues tokens, enforces scopes and routes calls across services. KYE Protocol™ adds the one check an AI agent makes it urgent to enforce: at the moment of a consequential call, is this inside the authority the agent’s principal actually delegated — not just the token it happens to hold?
- API invocation — a privileged call is admitted only when the agent’s delegated scope covers this operation; a call beyond that scope is refused, not waved through on a broad token.
- Scope & token grants — requesting or escalating a scope beyond the principal’s delegation is refused — over-broad grants are contained at the moment they are used, not just at issue time.
- Every act sealed — admit or refuse, the decision packs an Evidence Pack™ and a Replay-Proof™ verifiable from public keys alone — your access-audit file, built as it happens.
KYE™ proves the basis — it does not stand in for your gateway or identity server.
This is a governance layer, not an API gateway or IAM. KYE Protocol™ does not issue your tokens, terminate TLS, or route your traffic.
It checks the agent’s delegated authority at the action boundary, admits or refuses, and seals the proof. A call outside the agent’s scope is refused and routed to a human step-up — the refusal is itself evidence. See how the delegation chain is drawn on the authority diagram, then walk a sealed decision on the Evidence Pack™ demo.
Seeing is believing. Bring one real flow.
In a 20-minute walk-through we take one of your live flows — a privileged API call, a scope escalation, an agent-to-agent invocation — and show the AI action refused or admitted against the agent’s delegated authority, then hand you the sealed receipt to replay yourself. No credentials to share: the proof verifies against a public key set, the same runtime enforcement KYE Protocol™ uses to govern itself.