{"slug": "i-built-a-capability-based-security-layer-for-ai-agents-here-s-why-it-matters", "title": "I Built a Capability-Based Security Layer for AI Agents — Here's Why It Matters", "summary": "Developer Shubh Bhangoo has built Agent Firewall, a capability-based security layer for AI agents that provides fine-grained, cryptographically signed permissions with full lifecycle tracking. The system, now at v0.8 with SQLite-backed persistence, replaces binary API keys with delegable and attenuable capabilities, and includes HTTP and MCP boundaries for authorization. Bhangoo aims to make it production-ready with a v1.0 release.", "body_md": "I Built a Capability-Based Security Layer for AI Agents — Here's Why It Matters\n\nThe Problem Nobody's Talking About\n\nAI agents are everywhere now. They book flights, send emails, process payments, and access your codebase. But here's the question nobody asks:\n\nWho authorizes which agent can do what?\n\nMost people use API keys. An API key is binary — you have it or you don't. If your finance agent's key leaks, someone can drain your account. If your code-review agent gets compromised, it can push malicious commits. There's no middle ground.\n\nI kept hitting this wall while building agent prototypes. So I built something to fix it.\n\nWhat I Built\n\nAgent Firewall is a capability-based security layer for AI agents. It gives you fine-grained, cryptographically signed permissions with full lifecycle tracking.\n\nInstead of giving an agent a key that unlocks everything, you give it a capability:\n\nfrom agent_firewall import FirewallSDK\n\nsdk = FirewallSDK(\n\nrevocation_store_path=\"revocations.db\",\n\nlifecycle_store_path=\"lifecycle.db\",\n\n)\n\ncapability = sdk.issue(\n\nprivate_key=private_key,\n\nagent=\"finance-agent\",\n\ncapability=\"payments.send\",\n\nconstraints={\n\n\"amount_max\": 100,\n\n\"expires_at\": \"2026-08-30T00:00:00Z\"\n\n},\n\n)\n\nThat agent can now send payments — but only under 100, and only until August 30th. If you revoke the capability, it's dead immediately. If someone replays an old request, it's rejected.\n\nWhy Capabilities Beat API Keys\n\nAPI Keys vs Capabilities:\n\nAPI Keys:\n\nCapabilities:\n\nThe Capability Lifecycle\n\nEvery capability in Agent Firewall has an explicit lifecycle:\n\nISSUED\n\n↓\n\nDELEGATED\n\n↓\n\nATTENUATED\n\n↓\n\nUSED\n\n↓\n\nREPLAYED\n\n↓\n\nREVOKED\n\n↓\n\nDENIED\n\n↓\n\nEXPIRED\n\nThis isn't just logging — it's security state. You can query whether a capability was used, replayed, or revoked. You can delegate a capability to another agent with reduced authority (your finance agent delegates payments.send with amount_max=50 to a sub-agent). You can attenuate it yourself.\n\nAnd in v0.8, all of this persists to SQLite. Restart your service, and the revocation registry and lifecycle history survive.\n\nReal-World Boundaries\n\nAgent Firewall isn't just a library — it's a boundary layer.\n\nHTTP boundary: Maps incoming requests to capability namespaces.\n\nPOST /payments/refund\n\n↓\n\nhttp.POST.payments.refund\n\nMCP boundary: Authorizes Model Context Protocol tool calls before execution.\n\nBoth boundaries verify the capability, bind it to the agent identity, check constraints, and apply replay protection before allowing execution.\n\nThe Story Behind It\n\nSix months ago, I was building COVID detection models for college assignments. Standard undergrad ML stuff.\n\nThen I started playing with AI agents — LangChain, CrewAI, AutoGen — and kept running into the same problem: these agents have way too much power by default. An API key doesn't care which agent is calling, what it's doing, or when it should stop working.\n\nSo I went deep on capability-based security — a model from operating systems research where permissions are unforgeable tokens that can be delegated and attenuated. I built Agent Firewall to bring that model to the agent era.\n\nIt now has 1,438 passing tests, including adversarial regression coverage. It has architecture docs and a threat model. And yesterday, I shipped v0.8 with SQLite-backed lifecycle persistence.\n\nWhere It's Going\n\nv1.0 is the next milestone. I'm freezing the API, shipping full documentation, and making this production-ready. The goal is simple:\n\nEvery AI agent that calls a tool should have an authorization layer that understands who, what, and when.\n\nCheck out the repo: github.com/Shubhbhangoo/agent-firewall/tree/v0.8\n\nIf you're building agents that call tools — payments, APIs, databases, anything — I'd love your feedback. Drop an issue, open a PR, or just tell me what your authorization setup looks like today.\n\nI'm Shubh, a fresh CS grad building security infrastructure for the agent era. Follow along as I ship v1.0 and beyond.", "url": "https://wpnews.pro/news/i-built-a-capability-based-security-layer-for-ai-agents-here-s-why-it-matters", "canonical_source": "https://dev.to/shubhbhangoo/i-built-a-capability-based-security-layer-for-ai-agents-heres-why-it-matters-4kfc", "published_at": "2026-08-22 20:48:47+00:00", "updated_at": "2026-08-22 21:13:26.915544+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-infrastructure", "developer-tools"], "entities": ["Shubh Bhangoo", "Agent Firewall", "LangChain", "CrewAI", "AutoGen", "SQLite", "MCP"], "alternates": {"html": "https://wpnews.pro/news/i-built-a-capability-based-security-layer-for-ai-agents-here-s-why-it-matters", "markdown": "https://wpnews.pro/news/i-built-a-capability-based-security-layer-for-ai-agents-here-s-why-it-matters.md", "text": "https://wpnews.pro/news/i-built-a-capability-based-security-layer-for-ai-agents-here-s-why-it-matters.txt", "jsonld": "https://wpnews.pro/news/i-built-a-capability-based-security-layer-for-ai-agents-here-s-why-it-matters.jsonld"}}