[KongchangAI]
ConceptCapability Token / 能力凭证

Capability Token

A security mechanism in which an agent does not hold direct references to tools or resources but instead holds revocable, scoped tokens. Permissions are encoded within the token, and execution rights are obtained by presenting the token at call time, enabling fine-grained access control.

Timeline (last 90 days)

Oct 12

In implementation, the budget envelope is similar to a capability token: the token itself carries constraints such as an amount cap, a whitelist of target merchants and a time window, and the Agent can only present the token, unable to forge it or overspend.

Unverified50%

All Facts (1)

Unverified

In implementation, the budget envelope is similar to a capability token: the token itself carries constraints such as an amount cap, a whitelist of target merchants and a time window, and the Agent can only present the token, unable to forge it or overspend.

50%

Source Articles

A Personal AI Shouldn't Ask "Should I?" — Only One Question: MoneyOct 12Why AI Agent Tool Permission Checks Are Often Worthless: A Case for Architecture-Level SecuritySep 12