AuthScope

Inspiration

AI agents are becoming capable enough to act across codebases, identity systems, collaboration tools, ticketing systems, and business platforms. That power creates a new governance problem: agents should not just authenticate once and then roam freely. They need mission-bound authority: clear purpose, scoped permissions, human approvals, audit evidence, and emergency containment.

AuthScope was inspired by the idea that agent authorization should be tied to a specific mission, not just an API key, user token, or broad role.

What it does

AuthScope is a Mission Authority Service for AI agents. It defines what an agent is allowed to do, why it is allowed, who approved it, and when that authority should expire or be revoked.

It supports:

Mission creation, approval, delegation, and lifecycle management
Runtime policy evaluation before agent tool calls
Agent identity binding and signed decision evidence
Human approval flows for authority expansion
Mission leases and signed projections
Emergency containment and blast-radius analysis
Audit logs and lineage graphs
Integrations with services such as GitHub, Okta, Entra ID, Slack, Jira, Confluence, ServiceNow, and Salesforce
A sample Governed Coding Agent Workbench that demonstrates how Codex/OpenCode-style agents can be governed in real workflows

How we built it

We built AuthScope as a backend-first service in Go, with a clean internal domain model around missions, authority regions, actors, actions, approvals, containment rules, and integration bindings.

The service exposes REST APIs for mission evaluation, tool authorization, projections, leases, approvals, containment, and integrations. It includes an in-memory store for local demos and tests, plus PostgreSQL support for persistence.

We also added Docker Compose support for local startup, comprehensive backend tests with over 90% coverage, and a static sample app that demonstrates governed coding-agent behavior and enterprise integrations.

Challenges we ran into

One major challenge was keeping the model powerful without making it too abstract. Mission authority has to cover code edits, GitHub checks, Slack messages, identity claims, Jira transitions, Salesforce records, and ServiceNow changes, but all of those still need to feel like the same governance contract.

Another challenge was designing integrations with low coupling and high cohesion. Each integration has its own domain