Limit tokens and agents to what their owner may do

How to do it

Store the creator and the scopes on each key. Allow an action only when the key's scopes and the creator's current role both allow it. A key from a demoted admin then loses admin actions at once. When the creator leaves the organisation, suspend their keys and tell the owners. Name scopes as give each token only the scopes its job needs says.

Example

export const canWithKey = (key, creatorMembership, permission) =>
  key.scopes.includes(permission) && can(creatorMembership, permission);

def can_with_key(key, creator_membership, permission: str) -> bool:
    return permission in key.scopes and can(creator_membership, permission)

How to check

As a test admin, make a key with an admin scope, then demote the admin to member. The key's next admin call answers 403.