Revoking an agent token in seconds

Agent token revocation has to work at runtime. A tool-using agent can keep calling tools after a prompt injection, a wrong plan, or a compromised credential. AgentTrust ID issues opaque at_ tokens and checks them server-side, so a revoke call changes the next introspection result.

Opaque agent tokens

An opaque token is a server-side reference. The holder sends the token to the platform, and the platform checks live state: whether the token exists, whether it is expired, whether it has been revoked, and whether its scopes match the requested use.

In the Python SDK, token issue and introspection use the tokens API:

from agenttrustid import AgentTrustClient

client = AgentTrustClient.from_env()

agent = client.agents.create(
    name="research-agent",
    framework="custom",
    capabilities=["web:search", "docs:read"],
)

token = client.tokens.issue(
    agent_id=agent.id,
    scopes=["web:search"],
    ttl_seconds=300,
)

result = client.tokens.introspect(
    token.token,
    required_scopes=["web:search"],
)

assert result.active is True
assert result.agent_id == agent.id

The token string starts with at_. Its power lives in the server record, not in the string itself.

Self-contained credential risk

A self-contained credential keeps working until it expires unless every verifier checks a deny list. That creates an incident response window. The system may know the agent should stop, while verifiers still accept the credential.

For agents, that delay matters. A loop can run repeated tool calls before a person rotates a secret or redeploys a service. Shorter TTLs reduce the window, but they do not give an operator a stop control.

Revocation example

Revocation is a token operation. After revocation, the same token introspects as inactive.

from agenttrustid import AgentTrustClient

client = AgentTrustClient.from_env()

agent = client.agents.create(
    name="browser-agent",
    framework="custom",
    capabilities=["browser:fetch"],
)

token = client.tokens.issue(
    agent_id=agent.id,
    scopes=["browser:fetch"],
    ttl_seconds=300,
)

before = client.tokens.introspect(
    token.token,
    required_scopes=["browser:fetch"],
)
assert before.active

client.tokens.revoke(token.token, reason="operator_kill_switch")

after = client.tokens.introspect(
    token.token,
    required_scopes=["browser:fetch"],
)
assert after.active is False

That is the behavior a dashboard kill switch needs. Stop is a server-side state change.

Prevention

Use short-lived opaque tokens and introspect them on use. Short TTLs bound unattended lifetime. Server-side introspection gives operators a way to stop one token before the clock runs out.

Use per-agent tokens rather than shared service keys. If one agent goes wrong, revoke that token or revoke that agent. Other agents do not need a new shared secret.

Solving this with AgentTrust ID

AgentTrust ID binds token checks to the platform's live view of the agent, org, scopes, and revocation state. client.tokens.revoke(...) removes the token from the active path, and client.agents.revoke(...) stops an agent and its tokens.

This is the credential side of runtime authorization. The action side is the pre-flight check: every tool call can still go through client.actions.check(...) before it runs. Token revocation stops future authenticated use. Action checks decide whether the next action should run.

To issue and revoke agent tokens, start with the SDK guide. To talk through a kill-switch path for your agents, join the waitlist.

• Read the SDK guide
• Join the waitlist