The trust layer
for the agent economy.

Fidea's token issuance follows OAuth 2.1 with PKCE, adapted for machine-to-machine authentication. The Token Issuer validates the agent's identity against the Agent Registry, evaluates scopes against the Policy Engine, and issues an opaque token — not a JWT.

Opaque tokens have no embedded claims, which means they cannot be decoded, forwarded, or replayed. Every validation requires a round-trip to the issuer, enabling instant revocation. Tokens are scoped to a specific task, API permissions, and time window.

token = agent.authenticate(
    task_id="order-4521",
    scopes=["orders:read"],
    ttl=300  # 5 minutes
)

The Credential Proxy operates as a gateway between agents and external APIs. It validates the token, checks scope, retrieves the real credential from the secret store, injects it into the outgoing request, and forwards it to the target API.

The response passes back through the proxy, stripping any credential information. The agent never sees, handles, or stores the real API credential.

response = agent.proxy.get(
    "https://api.stripe.com/v1/charges",
    params={"limit": 1}
)

When Agent A spawns Agent B, it uses the on-behalf-of (OBO) flow. B receives its own identity and token, scoped to a subset of A's permissions. If B spawns C, the same narrowing applies.

Every delegation event is recorded in the Audit Service with cryptographic linking — each event references the hash of the previous, forming a tamper-evident chain. Delegation depth can be limited by policy.

child = agent.spawn(
    name="shipping-checker",
    scopes=["shipping:read"],
    max_depth=2
)

Every significant event — agent creation, token issuance, credential access, delegation, revocation — is recorded with the event type, agent identity, scopes, timestamp, and the SHA-256 hash of the previous entry.

Cryptographic linking means any tampering breaks the chain and is immediately detectable. The chain is append-only: entries cannot be modified or deleted.

trail = fidea.audit.query(
    agent_id="agent-abc123",
    event_types=["token.issued", "api.accessed"],
    since="2026-01-01T00:00:00Z"
)

The Policy Engine evaluates every token request against rules. Default: deny-all. Policies match on agent identity, requested scopes, time of day, delegation depth, and target API.

The kill switch is a global override: when activated, it immediately invalidates all tokens for that agent and all descendants, regardless of TTL. Policy evaluation happens at issuance time, keeping proxy latency low.

fidea.policy.create(
    name="billing-hours-only",
    match={"scopes": ["billing:*"]},
    conditions={
        "time_window": "09:00-17:00 UTC",
        "max_delegation_depth": 1
    },
    effect="allow"
)