Agent Wranglers

AGT-10Recommended

Give agent grants short lives

Agent access tokens last at most 5 minutes. A grant that no agent has used for 90 days ends by itself.

By Agent Wranglers. Updated .

How to do it

Short access tokens make revocation fast without a lookup on every call. Rotate refresh tokens on each use, and treat a reused refresh token as stolen by revoking the whole grant. Email the person before an unused grant ends, with a link to keep it. Agents that work for hours keep working through refresh, not through long tokens.

Examples

JavaScript example

const ACCESS_TOKEN_SECONDS = 300;
const IDLE_GRANT_DAYS = 90;
export const grantIsIdle = (lastUsedAt, now = Date.now()) => now - lastUsedAt > IDLE_GRANT_DAYS * 86_400_000;

Python example

ACCESS_TOKEN_SECONDS = 300
IDLE_GRANT_DAYS = 90

def grant_is_idle(last_used_at: datetime, now: datetime) -> bool:
    return now - last_used_at > timedelta(days=IDLE_GRANT_DAYS)

How to check

Decode an access token issued to a test agent. exp minus iat is 300 seconds or less. Use a refresh token twice, and the second use revokes the grant. A test grant left unused for 90 days in a time-shifted test is refused.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent/short-agent-grants">Agent Wranglers agents as users playbook</a>. In code you write, add a comment next to it with the same link.