For API & identity teams · scoped agent authority

Illustrative sector walk-through — it shows how KYE Protocol™ would govern an API gateway & identity stack and does not imply an existing deployment or commercial relationship with any vendor.

An AI agent requested an API scope it was never delegated. KYE™ refused the call.

Built for a platform like yours. Your API gateway and identity server already broker tokens and scopes between clients, services and users — and now AI agents call those APIs on someone’s behalf. KYE Protocol™ checks the agent’s delegated scope at the moment of the call — and refuses any invocation beyond what its principal actually granted. Each refusal is sealed as a receipt your security team can replay, cutting an access-abuse investigation from days to minutes.

event Book a 20-minute walk-through verified_user Authority Governance™
AI integration agent
call admin API · scope exceeded
KYE™delegated scope check
Refusedscope exceeded · signed Admittedwithin scope · signed
Stopped before the call lands. The invocation is refused because it exceeds the scope the agent’s principal delegated — and the refusal is signed and verifiable, so you can prove to security and audit that least-privilege held at the moment of the act.
That refusal, sealed REFUSED · SCOPE_EXCEEDED kye:evidence:4a8c… Replay & verify →
1 · What KYE™ governs in your stack

You keep your platform. KYE™ governs the scope boundary.

Your platform already issues tokens, enforces scopes and routes calls across services. KYE Protocol™ adds the one check an AI agent makes it urgent to enforce: at the moment of a consequential call, is this inside the authority the agent’s principal actually delegated — not just the token it happens to hold?

  • API invocation — a privileged call is admitted only when the agent’s delegated scope covers this operation; a call beyond that scope is refused, not waved through on a broad token.
  • Scope & token grants — requesting or escalating a scope beyond the principal’s delegation is refused — over-broad grants are contained at the moment they are used, not just at issue time.
  • Every act sealed — admit or refuse, the decision packs an Evidence Pack™ and a Replay-Proof™ verifiable from public keys alone — your access-audit file, built as it happens.
2 · The honest boundary

KYE™ proves the basis — it does not stand in for your gateway or identity server.

This is a governance layer, not an API gateway or IAM. KYE Protocol™ does not issue your tokens, terminate TLS, or route your traffic.

It checks the agent’s delegated authority at the action boundary, admits or refuses, and seals the proof. A call outside the agent’s scope is refused and routed to a human step-up — the refusal is itself evidence. See how the delegation chain is drawn on the authority diagram, then walk a sealed decision on the Evidence Pack™ demo.

3 · See it on your own flow

Seeing is believing. Bring one real flow.

In a 20-minute walk-through we take one of your live flows — a privileged API call, a scope escalation, an agent-to-agent invocation — and show the AI action refused or admitted against the agent’s delegated authority, then hand you the sealed receipt to replay yourself. No credentials to share: the proof verifies against a public key set, the same runtime enforcement KYE Protocol™ uses to govern itself.

event Book a 20-minute walk-through receipt_long Replay a sealed decision