Docs · Guides

Permits

Issue, verify, delegate and revoke the signed documents that bound what an agent may ask for.

What a permit carries

Field	Meaning
issuer	The DID that signed it. Its authority is what the permit rests on.
subject	Who may use it — usually an agent's DID.
actions	What may be done.
resources	What it may be done to.
conditions	Bounds: per-transaction maximums, totals, time windows.
not_before / expires_at	The window in which it can be used at all.
signature	Ed25519 over a canonical encoding of the above.

Issuing one

bengar id create --name acme
bengar id create --name agent

bengar permit issue \
  --issuer acme \
  --audience "$(bengar id show agent --json | jq -r .did)" \
  --can purchase \
  --with 'resource://company/procurement/*' \
  --max-per-tx 500000:TRY \
  --expires 30d \
  --out permit.txt

bengar permit verify permit.txt

All of it works offline. No database, no Gateway, no chain — which is the property that makes a permit worth holding.

Delegation and attenuation

A permit can be delegated onward, and a delegated permit can only narrow. Widening is refused as an attenuation violation, so a chain of delegations is bounded by its weakest link rather than by its most recent one.

Revocation

Revocation is by commitment and is idempotent. Revoking an ancestor revokes what descends from it. Verification consults the revocation registry, and a registry that cannot be reached is reported as such rather than treated as “not revoked”.

Removing a permit from the Console registry revokes nothing. The registry is an inventory; revocation is a separate, signed act.

Tenant isolation

A permit registered in one project is invisible in another, and using another tenant's identifiers answers the same way a typo does — confirming that something exists but belongs to somebody else is a cross-tenant oracle.

AVAILABLE Issue a permit

Where: The CLI: `bengar permit issue`

First: An issuer identity.

Not from the Console, on purpose: there is no issuer-key custody workflow, and a button there would be inventing an authority rather than exposing one.

AVAILABLE Register an issued permit — /projects/:id/permits

Where: Permits → Verify and register

First: A verifiable permit artifact.

Requires: PERMIT_ISSUER