The latest articles on DEV Community by Projetxana (@projetxana). https://dev.to/projetxana https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4172423%2Fee187bca-4408-404c-81b3-1f7b60ea3124.png https://dev.to/projetxana en Projetxana Fri, 09 Oct 2026 04:30:42 +0000 https://dev.to/projetxana/a-valid-signature-doesnt-mean-an-ai-agent-still-has-authority-1dm8 https://dev.to/projetxana/a-valid-signature-doesnt-mean-an-ai-agent-still-has-authority-1dm8 <p>Imagine an AI agent receives a valid, signed delegation to perform an action.</p> <p>The user later revokes that delegation in another system.</p> <p>The signature is still valid. The token may not have expired. But should the agent still be allowed to act?</p> <p><strong>Cryptographic validity and current delegated authority are two different questions.</strong></p> <p>OAuth introspection, short-lived credentials and existing authorization systems address important parts of this problem. But we wanted to explore one specific challenge: checking whether a delegated authority path is still active when agents and issuers operate across different trust domains.</p> <p>We built <strong>GATE — Authority Verification Network</strong> as an experimental Developer Preview to investigate this.</p> <h2> Try the live demonstration </h2> <p>Our hosted sandbox uses real HTTP requests to demonstrate three decisions:</p> <ol> <li>Two authority paths are active → <strong>VALID / ALLOW</strong> </li> <li>One path is revoked, but another survives → <strong>VALID / ALLOW</strong> </li> <li>Both paths are revoked → <strong>INVALID / DENY</strong> </li> </ol> <p>The demo uses a synthetic authority graph, not a third-party identity provider.</p> <p><strong><a href="https://gate-beta-nu.vercel.app/demo.html" rel="noopener noreferrer">Try the interactive demonstration</a></strong></p> <p><strong><a href="https://github.com/Projetxana/gate-authority-network" rel="noopener noreferrer">Explore the source code on GitHub</a></strong></p> <p>GATE also exposes an API for registering ES256 issuer keys and submitting signed authority events.</p> <h3> What we're not claiming </h3> <p>GATE currently runs on a single Canadian primary, without production regional replicas or a guaranteed external issuer propagation time. It does not replace authentication, OAuth, application policy enforcement or an independently audited production authorization system.</p> <p>We're looking for developers who work with AI agents, MCP tools, delegated permissions or cross-domain authorization.</p> <p><strong>I'd especially like to hear your thoughts on three questions:</strong></p> <ul> <li>How do you currently handle upstream revocation for delegated agents?</li> <li>Is this already adequately solved by your existing stack?</li> <li>Would a separate authority-state verification service make integration easier, or just add another dependency?</li> </ul> <p>We're inviting a small group of independent developers to evaluate the API with their own authority sources.</p> <p><a href="https://gate-beta-nu.vercel.app/" rel="noopener noreferrer">Join the GATE external developer beta</a></p> <p>Feedback and criticism are welcome.</p> ai security opensource devops