Preview documentation. The full Arsenal reference — ACT wire format, broker API, policy engine — lands next docs release.
The model
1
Agent requests a capability
agent.credentialsFor('openai') asks the broker for an ACT scoped to openai:*:*.2
Broker issues an ACT
Ed25519-signed token, 30s–10min TTL, scope-constrained, rate-limited.
3
Agent invokes the API
Every request goes through the broker’s proxy endpoint.
4
Broker injects credentials
Real API key is attached server-side. Agent never touches it.
ACT tokens
Format, claims, validity.
Broker
HTTP endpoints, mTLS, SSRF guard.
Policies
Declarative, CBOR-serialized.
Consent
Human-in-the-loop approvals.