When one agent needs another to act with its authority, hand off a scoped, expiring, revocable capability — not a secret. The other side verifies it in microseconds, even when the network to the issuer is gone.
Today, one agent authorizes another by sharing an API key — now it is you, forever — or by routing every action through an auth server that has to be up. Atlas replaces both with a signed hand‑off: this scope, until this time, revocable anytime.
The receiving side verifies from local trust material — no call to the issuer. Kill the auth server; verification still answers in microseconds.
A delegate only ever gets a subset of what the grantor holds — narrower scope, shorter life. Over‑asks are refused at issuance.
Signed revocation snapshots with verifiable freshness. Past your staleness budget, verification fails closed — never silently open.
An agent has to push to GitHub, deploy to Vercel, post to Slack. The unsafe way: hand it all three tokens — now one compromised prompt owns everything. The Atlas way: hand each agent one scoped, expiring, revocable capability. The tools keep their own secrets.
The tools hold secrets. An agent's most powerful move is presenting a capability it already has — scoped to one action, for minutes, revocable anytime.
Prompt-inject the coder all you like; the Vercel and Slack adapters still deny it. Least privilege, enforced at every tool.
Atlas isn't the agent and isn't the orchestrator — it's the trust fabric that makes letting agents act on your behalf safe. See the full story →
Five checks, in order, against the presented record. No hidden state — the trace below is the whole story.
A revocation performed while a relying party is partitioned from the issuer is not claimed observable. Atlas fails closed — then rejects the moment the partition heals and a fresh snapshot arrives.
Trigger it in the console above — Revoke under partition — and watch the field tear, fail closed, then reject on recovery.
Revoke access while the network is down and Atlas answers "can't know yet" — never "yes" — then enforces the revocation the moment the link heals.
Quick enough to check on every single action an agent takes — not just once at login.
Substrate‑independent tier, measured against the real implementation. Propagation, partition, cross‑domain and zero‑egress metrics require the two‑domain SPIRE lab and are not shown here — no number is fabricated.
A public answer key of hostile cases — forged signatures, stripped algorithms, transplanted tokens. Any implementation, in any language, must get all 28 right or it is broken.
Positive and adversarial vectors as static JSON. A Rust, Zig or Go verifier replays them and is caught the moment it diverges. Interop is the point.
Two independent SPIRE domains, network fault injection, out‑of‑band packet capture. Benchmarks run anywhere; the substrate experiments run on a real host — and refuse to fabricate a result if it isn't up.
Each card below is one experiment on a physical test bench where we actually cut the network, actually revoke, and actually capture the packets. The codes (S4, INV7, AT13…) are the spec clauses and acceptance tests that pin it.