---
title: "Limit tokens and agents to what their · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/roles-and-permissions/delegated-permissions
updated: 2026-10-20
licence: "All rights reserved"
---

# Limit tokens and agents to what their owner may do

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Roles and permissions](https://agentwranglers.se/playbook/accounts/roles-and-permissions)
- Rule: Give an API key, connected app or AI agent at most its creator's permissions. Check the creator's current role on every call.
- How: Store the creator and the scopes on each key. Allow an action only when the key's scopes and the creator's current role both allow it. A key from a demoted admin then loses admin actions at once. When the creator leaves the organisation, suspend their keys and tell the owners. Name scopes as [give each token only the scopes its job needs](https://agentwranglers.se/playbook/api-design/api-security/token-scopes) says.
- Check: As a test admin, make a key with an admin scope, then demote the admin to member. The key's next admin call answers 403.

Example:

```js
export const canWithKey = (key, creatorMembership, permission) =>
  key.scopes.includes(permission) && can(creatorMembership, permission);
```

```python
def can_with_key(key, creator_membership, permission: str) -> bool:
    return permission in key.scopes and can(creator_membership, permission)
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/roles-and-permissions/delegated-permissions`.

- Previous: [Make role changes count on the next request](https://agentwranglers.se/playbook/accounts/roles-and-permissions/role-changes-immediate)
- Next: [Let owners see who can do what](https://agentwranglers.se/playbook/accounts/roles-and-permissions/access-review)
- [Roles and permissions](https://agentwranglers.se/playbook/accounts/roles-and-permissions)