PassControl gates AI agent API calls without sharing real keys

PassControl is a source-available identity and credential gateway that sits between AI agents and API providers (OpenAI, Anthropic, Groq, Mistral, Together, DeepSeek). The core problem it solves is credential exposure: agents today typically hold real API keys, so a compromised agent or a leaked log can expose those secrets.

The solution works in six steps. First, instead of holding a real API key, an agent gets an Ed25519 keypair (a "passport") and holds only the private key. Second, when the agent needs to make a call, it locally signs a one-time challenge using that private key, producing a signature (never sent on the wire). Third, the gateway mints a short-lived "work-visa" token that carries the agent's identity, scope, budget, and an expiry, and the agent uses this visa in the API request (in place of the real key). Fourth, the gateway verifies the visa, checks the agent's identity and expiry, confirms a kill switch is armed (if the tenant is not revoked), and verifies that the request falls within the agent's allowed scope (provider, model, endpoint). Fifth, PassControl reserves the budget (tokens and cost) atomically before the provider call, so if the budget is exhausted, the call is rejected before any spend occurs. Sixth, the real provider key is resolved from a vault and injected in-flight; PassControl proxies the call to OpenAI or Anthropic, streams the response, and records the audit.

Adoption is designed to be frictionless. A team using the OpenAI or Anthropic SDK simply re-points the base URL to PassControl (e.g., `https://your-gateway/api/v1/openai`) and passes the work-visa instead of the real API key. The SDK and call shape remain unchanged—no agent code refactor. PassControl also runs as a native MCP server, so it can be integrated into Claude Desktop, Cursor, or Claude Code with the same policy boundary, budgets, and audit trail.

The control plane is called Control Tower. Operators inspect calls per agent and passport, viewing provider, model, status, token usage, cost, latency, and request identity in a single view. An instant tenant kill switch stops new requests at the gateway without touching provider keys or agent processes. Budget limits can be set both as total tokens and total cost per agent, and enforcement is atomic—if the budget is exhausted, the next call is rejected before any charge is incurred.

On auto-refresh: a local sidecar (not shown in the core agent code) mints and automatically refreshes the work-visa token. Even though the visa has a short lifespan (5 minutes in the examples), the sidecar re-mints it on demand and instantly re-mints on a 401 error, so a multi-hour agent session does not time out mid-task. A single long streaming call is verified once at the start and runs to completion regardless of token expiry.

The authors are candid about maturity and risk. PassControl is version 0.4.x, built by one developer, and not yet independently audited. It is built with security practices in mind (row-level security on every table, a single service-role-only decrypt path, an append-only audit log, tenant-isolation tests), but the authors emphasize that test-covered and careful is not the same as audited. They recommend running it against a non-critical key first.

The license is Business Source License 1.1, which is source-available (the full working core is free to inspect and self-host) but not an OSI-approved open-source license. The plan is open-core: paid hosting and an accountability layer (likely compliance and audit certifications) come later. PassControl differs from existing LLM gateways like LiteLLM and Portkey, which center on routing, caching, and observability behind a shared key. PassControl centers on per-agent cryptographic identity, capability scoping, per-agent budgets, and instant revocation, and runs drop-in alongside those tools.

PassControl addresses a practical security gap in AI agent deployment: most teams today embed real API keys (like OpenAI's `sk-proj-...` secrets) directly in agent code or environment variables, accepting the risk that an agent crash, compromise, or log leak exposes those credentials. The core insight is cryptographic separation—each agent gets a non-secret identity (an Ed25519 keypair) instead of the secret that pays for API calls. The agent signs a challenge locally using only its private key (never sent on the wire), the gateway validates that signature, checks the agent's scope and budget against a policy, and only then retrieves the real provider key from a secure vault and injects it into the proxied request.

This design achieves three concrete gains. First, revocation becomes instant and targeted: a team can kill access for one agent at the gateway without rotating keys across every provider or restarting agent processes. Second, budget enforcement becomes preventive rather than reactive: PassControl reserves token and cost limits atomically before the provider call, so overspend can be blocked rather than discovered after the fact. Third, audit trails are centralized at a single policy boundary—every governed call is logged with provider, model, status, tokens, cost, latency, and agent identity, giving operators one view of all agent activity.

The trade-off is that PassControl is early (v0.4.x), built solo, and not yet independently audited. The authors explicitly recommend testing against non-critical keys first and note that careful code is not the same as audited code. The source is available under the Business Source License 1.1 (not OSI open source), so users can inspect the credential path and self-host, but it is not freely modifiable open source. The authors also plan paid hosting and an accountability layer later.

No comments yet. Be the first to share your thoughts!