Capability-Based Access for Agents

Definition

Capability-based access grants authority through possession of a reference that permits defined operations on a resource. A limited access URL is one example. Agent governance must consider how such references are issued, passed between actors and invalidated.

Some authority is carried in references rather than derived from a user lookup at each request. That changes the review question: what can a holder do, and what happens if the reference is copied? An agent may forward a useful link without recognizing that it also transfers access.

What it covers

Grant

The operation and resource exposed by the reference.

Holder

Who can possess and use it.

Transfer

Whether another actor can receive the authority.

Expiry

How the reference ceases to work.

A capability may be read-only, short-lived or tied to one object, depending on the implementation. Do not assume these properties. Document whether the service supports revocation, recipient binding or narrower derived grants and what cannot be restricted.

In practice

Practical design patterns by Min.

• Use narrowly scoped references when the service supports them.
• Keep sensitive capability URLs out of public messages and telemetry.
• Test whether forwarding the reference transfers usable access.

Classify access-bearing references as sensitive outputs. Review where they can appear in summaries, browser history, referrers, traces and child-agent messages. When practical, pass a protected reference through a controlled service instead of exposing it to unrelated components.

Research notes

Source-grounded details and editorial applications. Follow each link for the original document.

Working example

Why the controls matter

The download example creates a disclosure risk even when the report body never enters the model context. A copied URL may be sufficient to retrieve the document. The operating record should identify the generated artifact and access decision without reproducing the secret reference.

Common pitfalls

• Treating an obscure URL as ordinary public metadata.
• Assuming the recipient must authenticate separately.
• Calling a scope restriction effective without service enforcement.

Capabilities and identity-based authorization can be combined. The useful choice depends on revocation, delegation and audit needs. Avoid presenting one model as universally superior; examine the authority each actual reference conveys and the consequences of its loss.

Questions for operational review

Use these questions to decide what evidence your team needs. They are editorial prompts, not a compliance checklist.

• Does possession alone grant access?
• Can the reference be narrowed or revoked?
• Which systems retain copies after the task ends?