Know Your Agent
What is the difference between AI agent permissions and API keys?
API keys prove which client called an endpoint. Agent permissions define capability scopes, tool allowlists, and just-in-time grants. AffixIO evaluates the runtime question and returns a signed allow or deny before the action executes.
Static API keys authenticate a caller. They do not prove that an agent may spend, export, or call a specific tool in this moment. Agents chain tools at machine speed, so frozen authority at authenticate-time becomes over-privilege.
A modern permission model scopes capabilities, binds tools to allowlists, and prefers short-lived grants. AffixIO sits at the action boundary: signed allow or deny with audit evidence. Identity providers still own agent identity lifecycle. AffixIO owns the decision proof.
FAQ
Is AffixIO an identity provider?
No. It is verification infrastructure beneath IAM for policy decisions.
Do MCP and LangChain need this?
Yes. Consequential tool calls still need a gate regardless of orchestrator.
Where is the deep guide?
See /agent-permissions/ and /agent-authorisation/.