PassControl gates AI agent API calls without sharing real keys

PassControl addresses a practical security gap in AI agent deployment: most teams today embed real API keys (like OpenAI's `sk-proj-...` secrets) directly in agent code or environment variables, accepting the risk that an agent crash, compromise, or log leak exposes those credentials. The core insight is cryptographic separation—each agent gets a non-secret identity (an Ed25519 keypair) instead of the secret that pays for API calls. The agent signs a challenge locally using only its private key (never sent on the wire), the gateway validates that signature, checks the agent's scope and budget against a policy, and only then retrieves the real provider key from a secure vault and injects it into the proxied request.

This design achieves three concrete gains. First, revocation becomes instant and targeted: a team can kill access for one agent at the gateway without rotating keys across every provider or restarting agent processes. Second, budget enforcement becomes preventive rather than reactive: PassControl reserves token and cost limits atomically before the provider call, so overspend can be blocked rather than discovered after the fact. Third, audit trails are centralized at a single policy boundary—every governed call is logged with provider, model, status, tokens, cost, latency, and agent identity, giving operators one view of all agent activity.

The trade-off is that PassControl is early (v0.4.x), built solo, and not yet independently audited. The authors explicitly recommend testing against non-critical keys first and note that careful code is not the same as audited code. The source is available under the Business Source License 1.1 (not OSI open source), so users can inspect the credential path and self-host, but it is not freely modifiable open source. The authors also plan paid hosting and an accountability layer later.