An AI agent requested an API scope it was never delegated. KYE™ refused the call.

AI integration agent

call admin API · scope exceeded

KYE™delegated scope check

Stopped before the call lands. The invocation is refused because it exceeds the scope the agent’s principal delegated — and the refusal is signed and verifiable, so you can prove to security and audit that least-privilege held at the moment of the act.

That refusal, sealed REFUSED · SCOPE_EXCEEDED kye:evidence:4a8c… Replay & verify →

1 · What KYE™ ™ governs in your stack

You keep your platform. KYE™ governs the scope boundary.

Your platform already issues tokens, enforces scopes and routes calls across services. KYE Protocol™ adds the one check an AI agent makes it urgent to enforce: at the moment of a consequential call, is this inside the authority the agent’s principal actually delegated — not just the token it happens to hold?

• API invocation — a privileged call is admitted only when the agent’s delegated scope covers this operation; a call beyond that scope is refused, not waved through on a broad token.
• Scope & token grants — requesting or escalating a scope beyond the principal’s delegation is refused — over-broad grants are contained at the moment they are used, not just at issue time.
• Every act sealed — admit or refuse, the decision packs an Evidence Pack™ and a Replay-Proof™ verifiable from public keys alone — your access-audit file, built as it happens.

2 · The honest boundary

KYE™ proves the basis — it does not stand in for your gateway or identity server.

This is a governance layer, not an API gateway or IAM. KYE Protocol™ does not issue your tokens, terminate TLS, or route your traffic.

It checks the agent’s delegated authority at the action boundary, admits or refuses, and seals the proof. A call outside the agent’s scope is refused and routed to a human step-up — the refusal is itself evidence. See how the delegation chain is drawn on the authority diagram, then walk a sealed decision on the Evidence Pack™ demo.

3 · See it on your own flow

Seeing is believing. Bring one real flow.

In a 20-minute walk-through we take one of your live flows — a privileged API call, a scope escalation, an agent-to-agent invocation — and show the AI action refused or admitted against the agent’s delegated authority, then hand you the sealed receipt to replay yourself. No credentials to share: the proof verifies against a public key set, the same runtime enforcement KYE Protocol™ uses to govern itself.

Related

Go deeper on scoped agent authority.

• Authority Governance™ — how authority is checked at the moment of the action, against who delegated what to whom.
• Authority diagram — how the delegation chain and its scope are drawn and checked.
• Evidence Pack™ demo — replay a sealed decision and verify it from public keys alone.

This page is an illustrative sector walk-through for API & identity teams; it shows how KYE Protocol™ would govern such a stack and does not describe or imply an existing deployment or commercial relationship with any named platform or vendor.

Canonical KYE™ surfaces referenced on this page: KYE Protocol™.